Overview

overview

10

Static

static

3

a0ba50ae13...18.exe

windows7-x64

10

a0ba50ae13...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a0ba50ae1395926ccea64cf252a188c0_JaffaCakes118

  • Size

    216KB

  • Sample

    240817-bz2w9szcmb

  • MD5

    a0ba50ae1395926ccea64cf252a188c0

  • SHA1

    0337b83054cb9725b1e0f175d470f972020d877c

  • SHA256

    604668211499b925c181b19228df492321323d9549c1b2fd440ed66c00eb809d

  • SHA512

    422217e68fe9a9b93ed0d9e624df6fb5ed471e9a2504ed98d2a86b25a20673d20d15640ecf36aaf5c5b9c3cc2ae2fe0198200158d225b90f976a2ec280bb318c

  • SSDEEP

    3072:DYtaMK/uxxnM3/7eFE+S2/goM2IFNGzBkl9sA:0J/nM36q+VM2CWs9

Score
10/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      a0ba50ae1395926ccea64cf252a188c0_JaffaCakes118

    • Size

      216KB

    • MD5

      a0ba50ae1395926ccea64cf252a188c0

    • SHA1

      0337b83054cb9725b1e0f175d470f972020d877c

    • SHA256

      604668211499b925c181b19228df492321323d9549c1b2fd440ed66c00eb809d

    • SHA512

      422217e68fe9a9b93ed0d9e624df6fb5ed471e9a2504ed98d2a86b25a20673d20d15640ecf36aaf5c5b9c3cc2ae2fe0198200158d225b90f976a2ec280bb318c

    • SSDEEP

      3072:DYtaMK/uxxnM3/7eFE+S2/goM2IFNGzBkl9sA:0J/nM36q+VM2CWs9

    Score
    10/10
    discoveryevasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks