Overview

overview

10

Static

static

3

db38e36da2...18.exe

windows7-x64

10

db38e36da2...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    db38e36da291d270393cdf21f1825e59_JaffaCakes118

  • Size

    41KB

  • Sample

    240911-z1bngatdke

  • MD5

    db38e36da291d270393cdf21f1825e59

  • SHA1

    081023c7cc8df28c1d27b42091e6db84c6a01c46

  • SHA256

    5a2a0fbb22b5821af344462dea3b7c5ea154600cd54b113d7b2bfad4254f1207

  • SHA512

    9876f6ea1aba558072a2a4042433be6b0268e557c1cb19b70e21748517998a4296fc0fc4f7e71b996ad861cdb8cd2db9fef834544d99e0a67c0a4e3e84493d42

  • SSDEEP

    768:Pj8VMqyyZCAXdZ1bgSoys/wpVcrswoA5hSiE:P4VRjXyF63AmP

Score
10/10
discoverypersistence

Malware Config

Targets

    • Target

      db38e36da291d270393cdf21f1825e59_JaffaCakes118

    • Size

      41KB

    • MD5

      db38e36da291d270393cdf21f1825e59

    • SHA1

      081023c7cc8df28c1d27b42091e6db84c6a01c46

    • SHA256

      5a2a0fbb22b5821af344462dea3b7c5ea154600cd54b113d7b2bfad4254f1207

    • SHA512

      9876f6ea1aba558072a2a4042433be6b0268e557c1cb19b70e21748517998a4296fc0fc4f7e71b996ad861cdb8cd2db9fef834544d99e0a67c0a4e3e84493d42

    • SSDEEP

      768:Pj8VMqyyZCAXdZ1bgSoys/wpVcrswoA5hSiE:P4VRjXyF63AmP

    Score
    10/10
    discoverypersistence

    • Modifies WinLogon for persistence

      persistence

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Modifies WinLogon

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks