Overview

overview

10

Static

static

3

2953374ad5...18.exe

windows7-x64

10

2953374ad5...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2953374ad5416ddc8be8fa36487342af_JaffaCakes118

  • Size

    208KB

  • Sample

    241009-c4pm6svhmk

  • MD5

    2953374ad5416ddc8be8fa36487342af

  • SHA1

    25a1e18ad6a120e2070b9f6232144a91b62ccdf7

  • SHA256

    c6a3f8e6695849ffbca71e0d13db7ce5201fc6b16cf6d45a04214ac9d119fd48

  • SHA512

    e188b1b254b78c4795958b98bcc12a29add7361b26d1433e27d5813e6e768ffb3c6b6b14cd09a80c8df27acba446caabdf11c00fbb94d8c326742eb2e3e53efd

  • SSDEEP

    3072:vw23I/TsmUPKMszPIU8+pHj7VxaPD4XitC62gqbHedbRz:vbOTsyIr47G7B86vc8bV

Score
10/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      2953374ad5416ddc8be8fa36487342af_JaffaCakes118

    • Size

      208KB

    • MD5

      2953374ad5416ddc8be8fa36487342af

    • SHA1

      25a1e18ad6a120e2070b9f6232144a91b62ccdf7

    • SHA256

      c6a3f8e6695849ffbca71e0d13db7ce5201fc6b16cf6d45a04214ac9d119fd48

    • SHA512

      e188b1b254b78c4795958b98bcc12a29add7361b26d1433e27d5813e6e768ffb3c6b6b14cd09a80c8df27acba446caabdf11c00fbb94d8c326742eb2e3e53efd

    • SSDEEP

      3072:vw23I/TsmUPKMszPIU8+pHj7VxaPD4XitC62gqbHedbRz:vbOTsyIr47G7B86vc8bV

    Score
    10/10
    discoveryevasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks