Overview

overview

8

Static

static

3

3b7035cb92...18.exe

windows7-x64

8

3b7035cb92...18.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    3b7035cb92a9c40acee5480d8bf08074_JaffaCakes118

  • Size

    17KB

  • Sample

    241012-wy8nmsthmf

  • MD5

    3b7035cb92a9c40acee5480d8bf08074

  • SHA1

    046fac840f3ad35a545de8700c0962b02e03a0bf

  • SHA256

    92e6b9e0aeff73123c13be28bc6f3c8c8859f6a8ee7d909aa4c921be0cc2654d

  • SHA512

    4714555041f06df0ade07b40cff14a512ed033e48738a4a849e47b19dce8a73e52f3a18cee99d0e7ac2556503f3f82df5b4db06a757548a7915f24f60c6a6c6a

  • SSDEEP

    384:FFevblxmcmZO2Zp+Nye8pqrmub8TyztsDN:FwpxmoKK8o8TyJc

Score
8/10
discoverypersistence

Malware Config

Targets

    • Target

      3b7035cb92a9c40acee5480d8bf08074_JaffaCakes118

    • Size

      17KB

    • MD5

      3b7035cb92a9c40acee5480d8bf08074

    • SHA1

      046fac840f3ad35a545de8700c0962b02e03a0bf

    • SHA256

      92e6b9e0aeff73123c13be28bc6f3c8c8859f6a8ee7d909aa4c921be0cc2654d

    • SHA512

      4714555041f06df0ade07b40cff14a512ed033e48738a4a849e47b19dce8a73e52f3a18cee99d0e7ac2556503f3f82df5b4db06a757548a7915f24f60c6a6c6a

    • SSDEEP

      384:FFevblxmcmZO2Zp+Nye8pqrmub8TyztsDN:FwpxmoKK8o8TyJc

    Score
    8/10
    discoverypersistence

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks