Overview

overview

8

Static

static

3

d3c480bf14...18.exe

windows7-x64

8

d3c480bf14...18.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    d3c480bf14d7c5c6af228f8322407a57_JaffaCakes118

  • Size

    40KB

  • Sample

    240908-hgc9hssamn

  • MD5

    d3c480bf14d7c5c6af228f8322407a57

  • SHA1

    1d5d5897bf6e839dd0e153f4ac62e6c3e5db2c64

  • SHA256

    aa7f763e307de6f790ae5d80916e8eb846335ae34e49edcd16ae2391237eb393

  • SHA512

    79d50068d64bbe61e0c8796f28d1a570341810a3a0c79a2d5bc511cef9b629c1e5c9840a2b3c9d85a04322f57a8fa405328976460e40523d74d2114c868c6008

  • SSDEEP

    768:FV42RV/UvuOsEOLuaoQUBaGrwAsVSBjDvm5kh4bBY3+IQZY:FvpqufEfTQGrwSB/vMY3+D+

Score
8/10
defense_evasiondiscovery

Malware Config

Targets

    • Target

      d3c480bf14d7c5c6af228f8322407a57_JaffaCakes118

    • Size

      40KB

    • MD5

      d3c480bf14d7c5c6af228f8322407a57

    • SHA1

      1d5d5897bf6e839dd0e153f4ac62e6c3e5db2c64

    • SHA256

      aa7f763e307de6f790ae5d80916e8eb846335ae34e49edcd16ae2391237eb393

    • SHA512

      79d50068d64bbe61e0c8796f28d1a570341810a3a0c79a2d5bc511cef9b629c1e5c9840a2b3c9d85a04322f57a8fa405328976460e40523d74d2114c868c6008

    • SSDEEP

      768:FV42RV/UvuOsEOLuaoQUBaGrwAsVSBjDvm5kh4bBY3+IQZY:FvpqufEfTQGrwSB/vMY3+D+

    Score
    8/10
    defense_evasiondiscovery

    • Drops file in Drivers directory

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks