Overview

overview

8

Static

static

3

0e4b60014b...18.exe

windows7-x64

8

0e4b60014b...18.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e4b60014bc17a927212b3b858a65fd8_JaffaCakes118

  • Size

    157KB

  • Sample

    241003-gv511ssbre

  • MD5

    0e4b60014bc17a927212b3b858a65fd8

  • SHA1

    edb976450e4b24541c99814fa90e243a88bb721a

  • SHA256

    361734c87df360816690d266606ebec4874a3c3f32797323fc9fb00e9098787a

  • SHA512

    aaf2f01e1f4d501f082972fbf070caaa5397df976882c2aa0350a670a94f68dcd31c5693d74fef09de5cc38bf1cc4b95428ae4a3a9cc5402be76e8b6bf347734

  • SSDEEP

    3072:++gclrN1rng/Tt3kRN0ixyOggadVH/CrV:++gxp3oKmDghj/Cp

Score
8/10
defense_evasiondiscoveryexecutionpersistence

Malware Config

Targets

    • Target

      0e4b60014bc17a927212b3b858a65fd8_JaffaCakes118

    • Size

      157KB

    • MD5

      0e4b60014bc17a927212b3b858a65fd8

    • SHA1

      edb976450e4b24541c99814fa90e243a88bb721a

    • SHA256

      361734c87df360816690d266606ebec4874a3c3f32797323fc9fb00e9098787a

    • SHA512

      aaf2f01e1f4d501f082972fbf070caaa5397df976882c2aa0350a670a94f68dcd31c5693d74fef09de5cc38bf1cc4b95428ae4a3a9cc5402be76e8b6bf347734

    • SSDEEP

      3072:++gclrN1rng/Tt3kRN0ixyOggadVH/CrV:++gxp3oKmDghj/Cp

    Score
    8/10
    defense_evasiondiscoveryexecutionpersistence

    • Creates new service(s)

      persistenceexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks