Overview

overview

8

Static

static

3

c864c1b4e1...18.exe

windows7-x64

8

c864c1b4e1...18.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    c864c1b4e17200be75086d4d83613afa_JaffaCakes118

  • Size

    105KB

  • Sample

    240829-hqmjjsycqh

  • MD5

    c864c1b4e17200be75086d4d83613afa

  • SHA1

    fa0b12798269ef69600d70063567e3e6a006d75d

  • SHA256

    543861a86e1b56d34fe5a10d398d52e8ee11d269dd997caa4de9ebbbe9903003

  • SHA512

    66517de944283a83232de854e3db0cda7b784850da8ad1674526c2e572f1112fd0f7efeeb362fd1695c44f2d98e492eb1328ba6b79a66cf635ff78964b23d924

  • SSDEEP

    1536:1U46qi9FOluMjC0CWGo/S1DWlDzEYPdrNMBUT/KqrEvAJNyTqJ:x6qeF8uOd3t/S1DeHJNMG2uEvAJNqa

Score
8/10
discoverypersistence

Malware Config

Targets

    • Target

      c864c1b4e17200be75086d4d83613afa_JaffaCakes118

    • Size

      105KB

    • MD5

      c864c1b4e17200be75086d4d83613afa

    • SHA1

      fa0b12798269ef69600d70063567e3e6a006d75d

    • SHA256

      543861a86e1b56d34fe5a10d398d52e8ee11d269dd997caa4de9ebbbe9903003

    • SHA512

      66517de944283a83232de854e3db0cda7b784850da8ad1674526c2e572f1112fd0f7efeeb362fd1695c44f2d98e492eb1328ba6b79a66cf635ff78964b23d924

    • SSDEEP

      1536:1U46qi9FOluMjC0CWGo/S1DWlDzEYPdrNMBUT/KqrEvAJNyTqJ:x6qeF8uOd3t/S1DeHJNMG2uEvAJNqa

    Score
    8/10
    discoverypersistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks