Overview

overview

10

Static

static

3

ead0ef98e0...18.exe

windows7-x64

10

ead0ef98e0...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ead0ef98e08f74f06ff3070f9a0153b2_JaffaCakes118

  • Size

    172KB

  • Sample

    240919-hw1ncswerh

  • MD5

    ead0ef98e08f74f06ff3070f9a0153b2

  • SHA1

    af272d7da4cd2445fcdef044993e485e0efe154d

  • SHA256

    595d10f9b53cd9d048a731df9438d52e523a8f3aa658bb12746d0a3808a06450

  • SHA512

    25bc506f2779c5669a515b4e251b6464f12029b86c1ed22ed87d126741c5646e30683b7813606fbb5f696301a55be277ccd2aa18ec1f5f1d428f5f91028b3c65

  • SSDEEP

    3072:kQ+veGrLtIgqED2Z8D/+lCbkQjRwkeIxNoaA5KiqzaDUv9kH9siM3pMQ8U3/Wwen:kLnBIhys87+83twkeIxNoaA5KiqzmUvs

Score
10/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      ead0ef98e08f74f06ff3070f9a0153b2_JaffaCakes118

    • Size

      172KB

    • MD5

      ead0ef98e08f74f06ff3070f9a0153b2

    • SHA1

      af272d7da4cd2445fcdef044993e485e0efe154d

    • SHA256

      595d10f9b53cd9d048a731df9438d52e523a8f3aa658bb12746d0a3808a06450

    • SHA512

      25bc506f2779c5669a515b4e251b6464f12029b86c1ed22ed87d126741c5646e30683b7813606fbb5f696301a55be277ccd2aa18ec1f5f1d428f5f91028b3c65

    • SSDEEP

      3072:kQ+veGrLtIgqED2Z8D/+lCbkQjRwkeIxNoaA5KiqzaDUv9kH9siM3pMQ8U3/Wwen:kLnBIhys87+83twkeIxNoaA5KiqzmUvs

    Score
    10/10
    discoveryevasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks