Overview

overview

10

Static

static

5

b5aa17fd21...18.exe

windows7-x64

10

b5aa17fd21...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b5aa17fd215bf28372b9a74a7a57416f_JaffaCakes118

  • Size

    755KB

  • Sample

    240822-axjr8ssgnm

  • MD5

    b5aa17fd215bf28372b9a74a7a57416f

  • SHA1

    1a05f25c3d3c4ec23e597416daeaadf94448e98b

  • SHA256

    8c3bebceac8eea414e9dd96f776490504d4f2984c8406d3a6bd290399687fcea

  • SHA512

    d3e85a68519edc9e0b194dca15b615a3442fcd6af8cb73e90af76c5b6794ca8b37fa313cff14d34d799302046f56f33ca54d7c8f4f0c5a93e92a687ed0c73bba

  • SSDEEP

    6144:gpqoa8aLaC/2OLSAN7gNVpNleQUohBfGPOtQciXeL/XYqGlebojSP2pjNhcAYnC/:gpqaC/2OGAtkCP4cejGSOpRK3CnIiw+

Score
10/10
discoverypersistence

Malware Config

Targets

    • Target

      b5aa17fd215bf28372b9a74a7a57416f_JaffaCakes118

    • Size

      755KB

    • MD5

      b5aa17fd215bf28372b9a74a7a57416f

    • SHA1

      1a05f25c3d3c4ec23e597416daeaadf94448e98b

    • SHA256

      8c3bebceac8eea414e9dd96f776490504d4f2984c8406d3a6bd290399687fcea

    • SHA512

      d3e85a68519edc9e0b194dca15b615a3442fcd6af8cb73e90af76c5b6794ca8b37fa313cff14d34d799302046f56f33ca54d7c8f4f0c5a93e92a687ed0c73bba

    • SSDEEP

      6144:gpqoa8aLaC/2OLSAN7gNVpNleQUohBfGPOtQciXeL/XYqGlebojSP2pjNhcAYnC/:gpqaC/2OGAtkCP4cejGSOpRK3CnIiw+

    Score
    10/10
    discoverypersistence

    • Modifies WinLogon for persistence

      persistence

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks