Overview

overview

10

Static

static

5

2eab8e8352...18.exe

windows7-x64

10

2eab8e8352...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2eab8e83524c6b046741ce0c1dce2dd8_JaffaCakes118

  • Size

    360KB

  • Sample

    241009-lewjvstgkl

  • MD5

    2eab8e83524c6b046741ce0c1dce2dd8

  • SHA1

    34b8012c883e6f6179670ca6a8dceaf2084ed4f5

  • SHA256

    7caba21d4e70a84cf6a51b21a9ce42d88275d2e38a0fa7e49df57f64eec6b312

  • SHA512

    88c56f0d7d7a8baf5783f5a35b1859cb977e629ec00d273b290f23da70b8935a87798c9285da33f1f1d3f7f88cb734aa5e957f0ce91b8fed42f36a3fd9fb2cd5

  • SSDEEP

    6144:tYZTNk3D6LyUXwLLk+cR3qh0GQ43VJRD0ew+/UO85IczI:tSNC80I+cR3R03VseuO85

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Targets

    • Target

      2eab8e83524c6b046741ce0c1dce2dd8_JaffaCakes118

    • Size

      360KB

    • MD5

      2eab8e83524c6b046741ce0c1dce2dd8

    • SHA1

      34b8012c883e6f6179670ca6a8dceaf2084ed4f5

    • SHA256

      7caba21d4e70a84cf6a51b21a9ce42d88275d2e38a0fa7e49df57f64eec6b312

    • SHA512

      88c56f0d7d7a8baf5783f5a35b1859cb977e629ec00d273b290f23da70b8935a87798c9285da33f1f1d3f7f88cb734aa5e957f0ce91b8fed42f36a3fd9fb2cd5

    • SSDEEP

      6144:tYZTNk3D6LyUXwLLk+cR3qh0GQ43VJRD0ew+/UO85IczI:tSNC80I+cR3R03VseuO85

    Score
    10/10
    discoveryevasionpersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Modifies firewall policy service

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Adds Run key to start application

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks