Overview

overview

8

Static

static

3

a8be49d99b...18.exe

windows7-x64

3

a8be49d99b...18.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a8be49d99be95dcad12ed9edb0f9979c_JaffaCakes118

  • Size

    160KB

  • Sample

    240818-3ymvhasbph

  • MD5

    a8be49d99be95dcad12ed9edb0f9979c

  • SHA1

    bc7683dde0fbec9fc11a388ed3550865d982e7d7

  • SHA256

    635798a04c33050dd9c0aff5b02dcca8dea168abd67e72d72287df2e920889bd

  • SHA512

    1180376ea8d339fd411f68971b0b51d151f077982793e246b47514e68328e107f3d59a69b805d814fcc887c81ca9bc38801ad2c2b2dff6d2ab32e3e7b9444717

  • SSDEEP

    1536:L/el+8Hruyv+mMiIAcI9vmQHv51skHMDnHgqAYsMKWqD7WCDYVRaJmg0k+X:z2LLuyv+mMi5cCeeM7JAJM3IymYVSe

Score
8/10
defense_evasiondiscoveryevasionpersistence

Malware Config

Targets

    • Target

      a8be49d99be95dcad12ed9edb0f9979c_JaffaCakes118

    • Size

      160KB

    • MD5

      a8be49d99be95dcad12ed9edb0f9979c

    • SHA1

      bc7683dde0fbec9fc11a388ed3550865d982e7d7

    • SHA256

      635798a04c33050dd9c0aff5b02dcca8dea168abd67e72d72287df2e920889bd

    • SHA512

      1180376ea8d339fd411f68971b0b51d151f077982793e246b47514e68328e107f3d59a69b805d814fcc887c81ca9bc38801ad2c2b2dff6d2ab32e3e7b9444717

    • SSDEEP

      1536:L/el+8Hruyv+mMiIAcI9vmQHv51skHMDnHgqAYsMKWqD7WCDYVRaJmg0k+X:z2LLuyv+mMi5cCeeM7JAJM3IymYVSe

    Score
    8/10
    discoverydefense_evasionevasionpersistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks