Overview

overview

10

Static

static

3

ecbaf9be2a...18.exe

windows7-x64

10

ecbaf9be2a...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ecbaf9be2acc4e048f7232d9863f2cc4_JaffaCakes118

  • Size

    96KB

  • Sample

    240920-dpqscswdmq

  • MD5

    ecbaf9be2acc4e048f7232d9863f2cc4

  • SHA1

    62edcd8e591f6c4af563aca8880d1f971250f26d

  • SHA256

    b005fdba5ebb141529874fc6143a7cde45111f694a8b3a97ccf28e3685c049cb

  • SHA512

    f294f6220306abf53b1d90a8bdb36bb26a9a66172f624a16e44afb2565f6f4a65b9dc5fb17bab46b378a85a34909b3dfdf22b556e3ee6e76600176e84a740d2c

  • SSDEEP

    1536:P22Eg52k9tyVQO8P8ychtwjj3RJNEo/knRzdnynE7RldNEP8lijOezNIjnZLL:PNE/kelychEzR3Ek65RldqzCn9L

Score
10/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      ecbaf9be2acc4e048f7232d9863f2cc4_JaffaCakes118

    • Size

      96KB

    • MD5

      ecbaf9be2acc4e048f7232d9863f2cc4

    • SHA1

      62edcd8e591f6c4af563aca8880d1f971250f26d

    • SHA256

      b005fdba5ebb141529874fc6143a7cde45111f694a8b3a97ccf28e3685c049cb

    • SHA512

      f294f6220306abf53b1d90a8bdb36bb26a9a66172f624a16e44afb2565f6f4a65b9dc5fb17bab46b378a85a34909b3dfdf22b556e3ee6e76600176e84a740d2c

    • SSDEEP

      1536:P22Eg52k9tyVQO8P8ychtwjj3RJNEo/knRzdnynE7RldNEP8lijOezNIjnZLL:PNE/kelychEzR3Ek65RldqzCn9L

    Score
    10/10
    discoveryevasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks