Overview

overview

10

Static

static

3

d5b1bc4942...18.exe

windows7-x64

10

d5b1bc4942...18.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    d5b1bc4942977769d0b129a1c2cba620_JaffaCakes118

  • Size

    408KB

  • Sample

    240909-fqccgashkp

  • MD5

    d5b1bc4942977769d0b129a1c2cba620

  • SHA1

    93ac79f5edf965144405c2e9354ecf1f42e26574

  • SHA256

    e573b42daae8b8ba60046b50530e9d94b5dd10c0447cd6093f3c7e5e28cd16ca

  • SHA512

    ab97acbdab4cab6818d914d0e0041b0f03db05c1b3614245e1fb5471888e8e97d0a9a1aef3943fa4c50101e880bd983369ed9ae2bd4aa6e4aa0af015868eff62

  • SSDEEP

    12288:shmjgh6pQscHg+yeTY/xLLVfsZvTmROE:BUHg+wrfsBmZ

Score
10/10
discoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      d5b1bc4942977769d0b129a1c2cba620_JaffaCakes118

    • Size

      408KB

    • MD5

      d5b1bc4942977769d0b129a1c2cba620

    • SHA1

      93ac79f5edf965144405c2e9354ecf1f42e26574

    • SHA256

      e573b42daae8b8ba60046b50530e9d94b5dd10c0447cd6093f3c7e5e28cd16ca

    • SHA512

      ab97acbdab4cab6818d914d0e0041b0f03db05c1b3614245e1fb5471888e8e97d0a9a1aef3943fa4c50101e880bd983369ed9ae2bd4aa6e4aa0af015868eff62

    • SSDEEP

      12288:shmjgh6pQscHg+yeTY/xLLVfsZvTmROE:BUHg+wrfsBmZ

    Score
    10/10
    discoveryevasionpersistencetrojan

    • Windows security bypass

      evasiontrojan

    • Disables taskbar notifications via registry modification

      evasion

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks