Overview

overview

10

Static

static

3

e26c334aca...18.exe

windows7-x64

10

e26c334aca...18.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    e26c334aca4235fa873b03fc214dd2f3_JaffaCakes118

  • Size

    202KB

  • Sample

    240915-n24j4asdrb

  • MD5

    e26c334aca4235fa873b03fc214dd2f3

  • SHA1

    22f16a47a983afe06005b55de473aaed9a27ce79

  • SHA256

    b578c817244af68fd63988fd4b00af7fcd36f452f533dda8acafc58b28f192f0

  • SHA512

    34dda4301929bbe4465b488277901062f73deab9724f364a72280e26526cfe6ecc2f594e5439efafe5ef0a8588f533141edaef68aa3ed24e7546ddbde437ec89

  • SSDEEP

    3072:Pm3xAixt4HsHV9akIRZt6XL6TPixomP0yd+kBOPvIedIdutqqJPOI88vKiW+Ecwz:Pm3+m4qV2Kp0y5wPwEIQtqqtOIJX8esD

Score
10/10
defense_evasiondiscoveryevasionpersistence

Malware Config

Targets

    • Target

      e26c334aca4235fa873b03fc214dd2f3_JaffaCakes118

    • Size

      202KB

    • MD5

      e26c334aca4235fa873b03fc214dd2f3

    • SHA1

      22f16a47a983afe06005b55de473aaed9a27ce79

    • SHA256

      b578c817244af68fd63988fd4b00af7fcd36f452f533dda8acafc58b28f192f0

    • SHA512

      34dda4301929bbe4465b488277901062f73deab9724f364a72280e26526cfe6ecc2f594e5439efafe5ef0a8588f533141edaef68aa3ed24e7546ddbde437ec89

    • SSDEEP

      3072:Pm3xAixt4HsHV9akIRZt6XL6TPixomP0yd+kBOPvIedIdutqqJPOI88vKiW+Ecwz:Pm3+m4qV2Kp0y5wPwEIQtqqtOIJX8esD

    Score
    10/10
    defense_evasiondiscoveryevasionpersistence

    • Modifies WinLogon for persistence

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks