Overview

overview

10

Static

static

3

ea79863fe2...18.exe

windows7-x64

10

ea79863fe2...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ea79863fe238a42f4779cdf359ecd6c3_JaffaCakes118

  • Size

    152KB

  • Sample

    240919-dn7z9ayapm

  • MD5

    ea79863fe238a42f4779cdf359ecd6c3

  • SHA1

    0ee6065f0e2e8d94c10eb7ba8630d3c62d1d64cc

  • SHA256

    c88d1791cd93dafcf0738baaa30e9d4948a8426ddd8f8cce422c09ecc423cb43

  • SHA512

    922bf4aab631a7a50dcf893d49d4d36cf1a7909b04b619f741b38bd7651e226d8c4392121b412fc6fcc3c835542542d5031dbf3d757e1591946186e6bc052643

  • SSDEEP

    3072:Urdsw3ndb8KvAmRPveYlUq/kzPi0gEr+YsBYPAZ1KHiLwcIaZ144oQZiEMl9p:AXduEGaUq8iHEXsCJR8ZyWKR

Score
10/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      ea79863fe238a42f4779cdf359ecd6c3_JaffaCakes118

    • Size

      152KB

    • MD5

      ea79863fe238a42f4779cdf359ecd6c3

    • SHA1

      0ee6065f0e2e8d94c10eb7ba8630d3c62d1d64cc

    • SHA256

      c88d1791cd93dafcf0738baaa30e9d4948a8426ddd8f8cce422c09ecc423cb43

    • SHA512

      922bf4aab631a7a50dcf893d49d4d36cf1a7909b04b619f741b38bd7651e226d8c4392121b412fc6fcc3c835542542d5031dbf3d757e1591946186e6bc052643

    • SSDEEP

      3072:Urdsw3ndb8KvAmRPveYlUq/kzPi0gEr+YsBYPAZ1KHiLwcIaZ144oQZiEMl9p:AXduEGaUq8iHEXsCJR8ZyWKR

    Score
    10/10
    discoveryevasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks