Overview

overview

8

Static

static

1

dbc80b1e02...18.exe

windows7-x64

8

dbc80b1e02...18.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dbc80b1e024152e219cabe2905487baa_JaffaCakes118

  • Size

    129KB

  • Sample

    240912-epbh4s1aje

  • MD5

    dbc80b1e024152e219cabe2905487baa

  • SHA1

    6f81bd75e72788bdace78d485b722050db73049e

  • SHA256

    8f40d690276f4a3d342d0674dfbfc7affdc83734cc8985aadb400f0264673444

  • SHA512

    bca2ea9d9da6f4773dd2ce00512c39914de54f7f11c74cac1925f44534e2a66e4c3fa3648346669c5dc2e6bfd463ff0146adb049f57ec3884a7362e80ae83ba5

  • SSDEEP

    3072:KSXQQ+OhQY505aWU7YG/OKT4mWkxW4IudpAKWuasHN4T:LXtv505+kG/rjWks4IW+KlN4T

Score
8/10
discoverypersistence

Malware Config

Targets

    • Target

      dbc80b1e024152e219cabe2905487baa_JaffaCakes118

    • Size

      129KB

    • MD5

      dbc80b1e024152e219cabe2905487baa

    • SHA1

      6f81bd75e72788bdace78d485b722050db73049e

    • SHA256

      8f40d690276f4a3d342d0674dfbfc7affdc83734cc8985aadb400f0264673444

    • SHA512

      bca2ea9d9da6f4773dd2ce00512c39914de54f7f11c74cac1925f44534e2a66e4c3fa3648346669c5dc2e6bfd463ff0146adb049f57ec3884a7362e80ae83ba5

    • SSDEEP

      3072:KSXQQ+OhQY505aWU7YG/OKT4mWkxW4IudpAKWuasHN4T:LXtv505+kG/rjWks4IW+KlN4T

    Score
    8/10
    discoverypersistence

    • Server Software Component: Terminal Services DLL

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks