Overview

overview

10

Static

static

3

d5c8d67724...18.exe

windows7-x64

10

d5c8d67724...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d5c8d677243618f07c31c28e57caaf7c_JaffaCakes118

  • Size

    152KB

  • Sample

    240909-g78mnsxgnf

  • MD5

    d5c8d677243618f07c31c28e57caaf7c

  • SHA1

    d01e2aef580f686a216fc265f65e4b7c457c15df

  • SHA256

    7e5ce298b169040bb5a92d8703d40770bd17d8a9662da3ea2f4881b4e3fb9b7f

  • SHA512

    cbf1b0a1cbe884bcfaccd63d974892e7b72c6310418675678bc3876166890c0e38b25f60afedb9001fdc6948914fb9e911237449ea1e40417a2ae77197736f55

  • SSDEEP

    3072:xmlcPTYhjIb4+7MxJUbaxI3zQyzLBuT+Fov:n4+7Mxa0yzGv

Score
10/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      d5c8d677243618f07c31c28e57caaf7c_JaffaCakes118

    • Size

      152KB

    • MD5

      d5c8d677243618f07c31c28e57caaf7c

    • SHA1

      d01e2aef580f686a216fc265f65e4b7c457c15df

    • SHA256

      7e5ce298b169040bb5a92d8703d40770bd17d8a9662da3ea2f4881b4e3fb9b7f

    • SHA512

      cbf1b0a1cbe884bcfaccd63d974892e7b72c6310418675678bc3876166890c0e38b25f60afedb9001fdc6948914fb9e911237449ea1e40417a2ae77197736f55

    • SSDEEP

      3072:xmlcPTYhjIb4+7MxJUbaxI3zQyzLBuT+Fov:n4+7Mxa0yzGv

    Score
    10/10
    discoveryevasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks