Overview

overview

10

Static

static

3

8276b32781...18.exe

windows7-x64

10

8276b32781...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8276b3278119ce34978c8b41f5193f3d_JaffaCakes118

  • Size

    195KB

  • Sample

    241031-kdgtmssrdt

  • MD5

    8276b3278119ce34978c8b41f5193f3d

  • SHA1

    73c318d9823063777587f3f19fd4f913e26e0a6a

  • SHA256

    efb326beaea5399a55722520c75b4dc106a7cfe2af2d60d2e4210f45f944f257

  • SHA512

    769f7968c3578f3c6adcc74736282ab907aef48e590dadc3da91c827bda9d69db4340cd5d20475dccf5f82ea8bd3bb0693278ed79d02d0f3b47e56ea6d6d8e5c

  • SSDEEP

    3072:6wed85Ynt+p/zPhyz/5DzDVTKBbe0SvvT8Ih882dWFCVArn8z:6wqIYtUYTTKBbyLNhOdg78

Score
10/10
discoveryevasionexecutionpersistencetrojan

Malware Config

Targets

    • Target

      8276b3278119ce34978c8b41f5193f3d_JaffaCakes118

    • Size

      195KB

    • MD5

      8276b3278119ce34978c8b41f5193f3d

    • SHA1

      73c318d9823063777587f3f19fd4f913e26e0a6a

    • SHA256

      efb326beaea5399a55722520c75b4dc106a7cfe2af2d60d2e4210f45f944f257

    • SHA512

      769f7968c3578f3c6adcc74736282ab907aef48e590dadc3da91c827bda9d69db4340cd5d20475dccf5f82ea8bd3bb0693278ed79d02d0f3b47e56ea6d6d8e5c

    • SSDEEP

      3072:6wed85Ynt+p/zPhyz/5DzDVTKBbe0SvvT8Ih882dWFCVArn8z:6wqIYtUYTTKBbyLNhOdg78

    Score
    10/10
    discoveryevasionexecutionpersistencetrojan

    • UAC bypass

      evasiontrojan

    • Creates new service(s)

      persistenceexecution

    • Stops running service(s)

      evasionexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Checks whether UAC is enabled

      evasiontrojan

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2
T1569

Service Execution

2
T1569.002

Persistence

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

2
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

2
T1112

Credential Access

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1
T1489

Tasks