Overview

overview

7

Static

static

1

f6166cdc0a...18.exe

windows7-x64

7

f6166cdc0a...18.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    f6166cdc0a097e10128d4de973add6e1_JaffaCakes118

  • Size

    361KB

  • Sample

    240925-qe24vsxblm

  • MD5

    f6166cdc0a097e10128d4de973add6e1

  • SHA1

    f000eee5390658f073be3c562dac06da540e5ea3

  • SHA256

    1dc49260ddb0dafb9ed33f897077de15f8f1611d3c667c5ab31f80be68244bd2

  • SHA512

    0605469a2b157326deb9f153218bf0fa3b36eb4c7e19a07e212c0dc81fe977779644e4b3c70de115f37501d90ca1272992f7f0a1573702ae90bc876979df59e9

  • SSDEEP

    6144:p86yxJmmxlnW2PRTTC0VRNhPpWsnxiP8AukSC:poPxIWBhVPIsno8rkT

Score
7/10
discoverypersistence

Malware Config

Targets

    • Target

      f6166cdc0a097e10128d4de973add6e1_JaffaCakes118

    • Size

      361KB

    • MD5

      f6166cdc0a097e10128d4de973add6e1

    • SHA1

      f000eee5390658f073be3c562dac06da540e5ea3

    • SHA256

      1dc49260ddb0dafb9ed33f897077de15f8f1611d3c667c5ab31f80be68244bd2

    • SHA512

      0605469a2b157326deb9f153218bf0fa3b36eb4c7e19a07e212c0dc81fe977779644e4b3c70de115f37501d90ca1272992f7f0a1573702ae90bc876979df59e9

    • SSDEEP

      6144:p86yxJmmxlnW2PRTTC0VRNhPpWsnxiP8AukSC:poPxIWBhVPIsno8rkT

    Score
    7/10
    discoverypersistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks