Overview

overview

10

Static

static

10

f8e9313f9c...18.msi

windows7-x64

f8e9313f9c...18.msi

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f8e9313f9c993e3ff4754c28725d7a5f_JaffaCakes118

  • Size

    17.8MB

  • Sample

    240926-wf7cvszemq

  • MD5

    f8e9313f9c993e3ff4754c28725d7a5f

  • SHA1

    e56349d04381300475e1576ee4bde081e39141af

  • SHA256

    d0772a8be491a0176211e41812314a98e61ebd0cfeecc6636c6b691b8f8a2b4d

  • SHA512

    4bd82421566247e31a1c2b3d9244f8a99a1d380efcba55f7c0172256c503b2a98b1e892db9ec39317d3749daf8856156a0c4c23815df8f340583ff961258bef4

  • SSDEEP

    393216:3n50SkxQKakQGVE2D5MFtca9r1wWZveUS3ax6Q3jqbjVPiJXVyE:pu5akHVEc5ULjwWZveUs8jq3VKJXx

Score
10/10
purplefoxdiscoverypersistenceprivilege_escalationrootkit

Malware Config

Targets

    • Target

      f8e9313f9c993e3ff4754c28725d7a5f_JaffaCakes118

    • Size

      17.8MB

    • MD5

      f8e9313f9c993e3ff4754c28725d7a5f

    • SHA1

      e56349d04381300475e1576ee4bde081e39141af

    • SHA256

      d0772a8be491a0176211e41812314a98e61ebd0cfeecc6636c6b691b8f8a2b4d

    • SHA512

      4bd82421566247e31a1c2b3d9244f8a99a1d380efcba55f7c0172256c503b2a98b1e892db9ec39317d3749daf8856156a0c4c23815df8f340583ff961258bef4

    • SSDEEP

      393216:3n50SkxQKakQGVE2D5MFtca9r1wWZveUS3ax6Q3jqbjVPiJXVyE:pu5akHVEc5ULjwWZveUs8jq3VKJXx

    Score
    8/10
    discoverypersistenceprivilege_escalation

    • Drops file in Drivers directory

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks