General
-
Target
e10446a6af386969ec2cef27cc25ce03_JaffaCakes118
-
Size
3.1MB
-
Sample
240914-zqfvfawamm
-
MD5
e10446a6af386969ec2cef27cc25ce03
-
SHA1
15d6221f7422de936a719711728d121c2d7ae42b
-
SHA256
b4a88f92a866abef3e6b49480fbfaae37fd300f0d843ccd91ea547f264cc22d9
-
SHA512
77aa8ab80dd1af7b46348cae1766b2a20af6355df1a267d4511ea1ab472b7f96cf6d0bfb00bc282f9c31980c0259c9d5322baf2a8dccc91633c4432de83587e7
-
SSDEEP
49152:Nz09yjY6E8FyoabFCnmSpmScFqVNEp94zDju71XyvPAsP+xy:Nza6UbYmCLxe94zDju71XyvPAZy
Malware Config
Targets
-
-
Target
e10446a6af386969ec2cef27cc25ce03_JaffaCakes118
-
Size
3.1MB
-
MD5
e10446a6af386969ec2cef27cc25ce03
-
SHA1
15d6221f7422de936a719711728d121c2d7ae42b
-
SHA256
b4a88f92a866abef3e6b49480fbfaae37fd300f0d843ccd91ea547f264cc22d9
-
SHA512
77aa8ab80dd1af7b46348cae1766b2a20af6355df1a267d4511ea1ab472b7f96cf6d0bfb00bc282f9c31980c0259c9d5322baf2a8dccc91633c4432de83587e7
-
SSDEEP
49152:Nz09yjY6E8FyoabFCnmSpmScFqVNEp94zDju71XyvPAsP+xy:Nza6UbYmCLxe94zDju71XyvPAZy
Score10/10-
Modifies WinLogon for persistence
-
Adds policy Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Modifies WinLogon
-
Network Share Discovery
Attempt to gather information on host network.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Privilege Escalation
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2