Overview

overview

8

Static

static

3

e0461758f3...18.exe

windows7-x64

8

e0461758f3...18.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    e0461758f348f54c048b90b8c3e2e495_JaffaCakes118

  • Size

    212KB

  • Sample

    240914-qn4ztawflg

  • MD5

    e0461758f348f54c048b90b8c3e2e495

  • SHA1

    673e8777e55d4f0c39afd0bb12896eee596e0835

  • SHA256

    c5924021db57fa1c52248d2216d5df9e279d0e4c46418b8b24735fab14678058

  • SHA512

    d3de4a73027fee4ca3b26f21285eff80248523a0432880e38abfee4702223e9c51ff33768da941e4bf9f632d8ac77a0bcd12f9b723f35c4c9b97aca1c18d0320

  • SSDEEP

    6144:jK++6kkaZr2LjpSUrMCExBtTkkzAekZYU:R+6kkaZSv0UrM9btgcD0YU

Score
8/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      e0461758f348f54c048b90b8c3e2e495_JaffaCakes118

    • Size

      212KB

    • MD5

      e0461758f348f54c048b90b8c3e2e495

    • SHA1

      673e8777e55d4f0c39afd0bb12896eee596e0835

    • SHA256

      c5924021db57fa1c52248d2216d5df9e279d0e4c46418b8b24735fab14678058

    • SHA512

      d3de4a73027fee4ca3b26f21285eff80248523a0432880e38abfee4702223e9c51ff33768da941e4bf9f632d8ac77a0bcd12f9b723f35c4c9b97aca1c18d0320

    • SSDEEP

      6144:jK++6kkaZr2LjpSUrMCExBtTkkzAekZYU:R+6kkaZSv0UrM9btgcD0YU

    Score
    8/10
    discoveryevasionpersistence

    • Disables RegEdit via registry modification

      evasion

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks