Overview

overview

10

Static

static

3

ee12ff2b7e...18.exe

windows7-x64

10

ee12ff2b7e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ee12ff2b7e6ea4788c62fdb82e9a8769_JaffaCakes118

  • Size

    698KB

  • Sample

    240920-vwp8vaxgqe

  • MD5

    ee12ff2b7e6ea4788c62fdb82e9a8769

  • SHA1

    32d1a569e36ff40e81f0d6d851ec5591c78527da

  • SHA256

    9ecfef9aeac40801b4e378a2f0e17b56fc3a2b50ac2c0ed9d00f124cd27f4b9b

  • SHA512

    7a55fa9f64f70e615664c1b103f0896921922a20df252d28696026477df3572987921ec96000a8d5b78a7d5cd2229168fb06073f97f212c168a27f63c15e2710

  • SSDEEP

    12288:g3TdtLW5WIj1YSSdFxUBSXYb9lx/9AgHLo8OW+rB8:aDsj1dEEBcYPx/igrp+a

Score
10/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      ee12ff2b7e6ea4788c62fdb82e9a8769_JaffaCakes118

    • Size

      698KB

    • MD5

      ee12ff2b7e6ea4788c62fdb82e9a8769

    • SHA1

      32d1a569e36ff40e81f0d6d851ec5591c78527da

    • SHA256

      9ecfef9aeac40801b4e378a2f0e17b56fc3a2b50ac2c0ed9d00f124cd27f4b9b

    • SHA512

      7a55fa9f64f70e615664c1b103f0896921922a20df252d28696026477df3572987921ec96000a8d5b78a7d5cd2229168fb06073f97f212c168a27f63c15e2710

    • SSDEEP

      12288:g3TdtLW5WIj1YSSdFxUBSXYb9lx/9AgHLo8OW+rB8:aDsj1dEEBcYPx/igrp+a

    Score
    10/10
    discoveryevasionpersistence

    • Modifies WinLogon for persistence

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks