Overview

overview

10

Static

static

3

ed728b516b...18.exe

windows7-x64

10

ed728b516b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed728b516b9def3b0828d7d8ad8e2a43_JaffaCakes118

  • Size

    504KB

  • Sample

    240920-m6wjlstbnm

  • MD5

    ed728b516b9def3b0828d7d8ad8e2a43

  • SHA1

    49bd2ec3f81bd186d70a8180ca6b10a59ed964f8

  • SHA256

    811d40d68a8341c4a6ab40293f114d8cb7c5c23c190c7dfd92c820e05ff6f301

  • SHA512

    cf1355dc78d648342d77427ab79e1d6e10f3bd4b7a920ff997781e9e2dbbbce4a51f5aeb4b8277256454896680e24b83b46448d8dfc10c708d171445f13fa95b

  • SSDEEP

    12288:jVk2yEC4GLRPVXCMMvAw7VAw6/IJY2ka3mH7wQaWS:jqt1hHy55OL2n3E70W

Score
10/10
aspackv2discoverypersistence

Malware Config

Targets

    • Target

      ed728b516b9def3b0828d7d8ad8e2a43_JaffaCakes118

    • Size

      504KB

    • MD5

      ed728b516b9def3b0828d7d8ad8e2a43

    • SHA1

      49bd2ec3f81bd186d70a8180ca6b10a59ed964f8

    • SHA256

      811d40d68a8341c4a6ab40293f114d8cb7c5c23c190c7dfd92c820e05ff6f301

    • SHA512

      cf1355dc78d648342d77427ab79e1d6e10f3bd4b7a920ff997781e9e2dbbbce4a51f5aeb4b8277256454896680e24b83b46448d8dfc10c708d171445f13fa95b

    • SSDEEP

      12288:jVk2yEC4GLRPVXCMMvAw7VAw6/IJY2ka3mH7wQaWS:jqt1hHy55OL2n3E70W

    Score
    10/10
    aspackv2discoverypersistence

    • Modifies WinLogon for persistence

      persistence

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks