Overview

overview

10

Static

static

3

8ee70424dc...18.exe

windows7-x64

10

8ee70424dc...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8ee70424dc2c6ce3ccff4de5a570ce40_JaffaCakes118

  • Size

    516KB

  • Sample

    240812-qqgx3axcld

  • MD5

    8ee70424dc2c6ce3ccff4de5a570ce40

  • SHA1

    1a8ecca7476add9180c011732df7f7932e0fc5ec

  • SHA256

    dce4aabc0cd8c304a0c6c9f37e344120805da50e443ddf2d83fdd755f6f8ab52

  • SHA512

    0bfdd47d8f97b1dc8cab8116a3a05f1d1ceaa1c3d649c9612a2c93ffcfba7a9289e34035ad19493e2b7493a550e19667de99d5cef1645410d04b30ffbfa6f7ec

  • SSDEEP

    12288:JPuNZqweudOsul3i6oYfVv8i8bGmzCTn2UPkgV6u2phPjSigqBP:JPUHxds3XgCTn2x5h

Score
10/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      8ee70424dc2c6ce3ccff4de5a570ce40_JaffaCakes118

    • Size

      516KB

    • MD5

      8ee70424dc2c6ce3ccff4de5a570ce40

    • SHA1

      1a8ecca7476add9180c011732df7f7932e0fc5ec

    • SHA256

      dce4aabc0cd8c304a0c6c9f37e344120805da50e443ddf2d83fdd755f6f8ab52

    • SHA512

      0bfdd47d8f97b1dc8cab8116a3a05f1d1ceaa1c3d649c9612a2c93ffcfba7a9289e34035ad19493e2b7493a550e19667de99d5cef1645410d04b30ffbfa6f7ec

    • SSDEEP

      12288:JPuNZqweudOsul3i6oYfVv8i8bGmzCTn2UPkgV6u2phPjSigqBP:JPUHxds3XgCTn2x5h

    Score
    10/10
    discoveryevasionpersistence

    • Modifies firewall policy service

      evasion

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks