Overview

overview

10

Static

static

3

538dc278b2...18.exe

windows7-x64

10

538dc278b2...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    538dc278b2024fbcfa70d958da529b17_JaffaCakes118

  • Size

    200KB

  • Sample

    241017-y6aspavakg

  • MD5

    538dc278b2024fbcfa70d958da529b17

  • SHA1

    75e8715eda770caf243fe81d02b7d2f39ad4a2a8

  • SHA256

    eff8e68df8862cae43431d17826511daa3761241d3ee7575273ecca3a4388615

  • SHA512

    06007240d6015bb6f7fb69f3c5ce96ebe87025d61c5c0a62ef5468aafb24322ced68eec8cb2b836a04b115e180a9947f7079f0ace84647c517aeb6a7d7192ea9

  • SSDEEP

    3072:LCITo/0YxwN0tQ9nLHbB9WPliBs2HWWEakGJm9W:LCduN4QxL7B9WPli+yWWEazd

Score
10/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      538dc278b2024fbcfa70d958da529b17_JaffaCakes118

    • Size

      200KB

    • MD5

      538dc278b2024fbcfa70d958da529b17

    • SHA1

      75e8715eda770caf243fe81d02b7d2f39ad4a2a8

    • SHA256

      eff8e68df8862cae43431d17826511daa3761241d3ee7575273ecca3a4388615

    • SHA512

      06007240d6015bb6f7fb69f3c5ce96ebe87025d61c5c0a62ef5468aafb24322ced68eec8cb2b836a04b115e180a9947f7079f0ace84647c517aeb6a7d7192ea9

    • SSDEEP

      3072:LCITo/0YxwN0tQ9nLHbB9WPliBs2HWWEakGJm9W:LCduN4QxL7B9WPli+yWWEazd

    Score
    10/10
    discoveryevasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks