Overview

overview

10

Static

static

3

af387b3ebd...18.exe

windows7-x64

10

af387b3ebd...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    af387b3ebd669ff3d9200cf26f854f5e_JaffaCakes118

  • Size

    76KB

  • Sample

    240820-pnjhfavhmq

  • MD5

    af387b3ebd669ff3d9200cf26f854f5e

  • SHA1

    674122f1b88b65cbd01b88560420d6fbacfd70c3

  • SHA256

    925759244bcb21f629eee0c19200b7ec6814dc5935f0ce98c6cd9e3075132c26

  • SHA512

    c63fa378c0f0715dd43980795a4c46cdd3fab9b26ef8a184019fe1834aa64baa4d67c2527e6d1cd58992cdb35afe985438e7a3f98e0d7bf36eaaf92e8ca91fc0

  • SSDEEP

    1536:ufq44Q2etZbfbOGK4W6EjIMuAZGKkx1nLCDlbua6TaX91UUFlJKB:Nf4ZbzOGUjIM3ZGhnLC9oarTwB

Score
10/10
defense_evasiondiscoveryevasionpersistence

Malware Config

Targets

    • Target

      af387b3ebd669ff3d9200cf26f854f5e_JaffaCakes118

    • Size

      76KB

    • MD5

      af387b3ebd669ff3d9200cf26f854f5e

    • SHA1

      674122f1b88b65cbd01b88560420d6fbacfd70c3

    • SHA256

      925759244bcb21f629eee0c19200b7ec6814dc5935f0ce98c6cd9e3075132c26

    • SHA512

      c63fa378c0f0715dd43980795a4c46cdd3fab9b26ef8a184019fe1834aa64baa4d67c2527e6d1cd58992cdb35afe985438e7a3f98e0d7bf36eaaf92e8ca91fc0

    • SSDEEP

      1536:ufq44Q2etZbfbOGK4W6EjIMuAZGKkx1nLCDlbua6TaX91UUFlJKB:Nf4ZbzOGUjIM3ZGhnLC9oarTwB

    Score
    10/10
    defense_evasiondiscoveryevasionpersistence

    • Modifies security service

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Modify Registry

3
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks