Overview

overview

10

Static

static

3

ed46a1b2a8...18.exe

windows7-x64

10

ed46a1b2a8...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed46a1b2a8276cd0913f358e7d680298_JaffaCakes118

  • Size

    124KB

  • Sample

    240920-k6y9dsyhql

  • MD5

    ed46a1b2a8276cd0913f358e7d680298

  • SHA1

    13fc5a81242f0ce49155589a3f4f71bcc45d5c00

  • SHA256

    b8dbe97f676c8d928d426db3d9f4c47bced056ef9387fd1cb156fbf2de8096de

  • SHA512

    cded2ece2b2ead951d01049c4c56e1a1fccdcece28e57a680da2ab610f33a3b7a797ee01bb95ce6057aa01975317dd39e356d8e36b41d387b3b3767c0e929339

  • SSDEEP

    3072:VphJovvXFwRBW1cQoj9MYuPCNtrK6tJTVUa370hvBb:nu/d2QRYjfTVU407

Score
10/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      ed46a1b2a8276cd0913f358e7d680298_JaffaCakes118

    • Size

      124KB

    • MD5

      ed46a1b2a8276cd0913f358e7d680298

    • SHA1

      13fc5a81242f0ce49155589a3f4f71bcc45d5c00

    • SHA256

      b8dbe97f676c8d928d426db3d9f4c47bced056ef9387fd1cb156fbf2de8096de

    • SHA512

      cded2ece2b2ead951d01049c4c56e1a1fccdcece28e57a680da2ab610f33a3b7a797ee01bb95ce6057aa01975317dd39e356d8e36b41d387b3b3767c0e929339

    • SSDEEP

      3072:VphJovvXFwRBW1cQoj9MYuPCNtrK6tJTVUa370hvBb:nu/d2QRYjfTVU407

    Score
    10/10
    discoveryevasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks