Overview

overview

10

Static

static

10

JaffaCakes...19.msi

windows7-x64

6

JaffaCakes...19.msi

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_ed3edf8fdb2cd2f027127f4fb1fe7019

  • Size

    264KB

  • Sample

    250110-y3n6xavrby

  • MD5

    ed3edf8fdb2cd2f027127f4fb1fe7019

  • SHA1

    e876622ade868b5c8461b80a9b8e4961e9427b2e

  • SHA256

    ece2bea42a77b9c098899150a002e9f702cc7cf5b43bc8f674c61d5adaf905d3

  • SHA512

    051d9ff3bc18233ee3174113b566a1bbd653588b9070563f9627c51315cd0e39bc6151a92f5df91cc8c809cd021ae79ab43ac0b88013930f7da7864c68a10d42

  • SSDEEP

    3072:XmWqcL903DaYlA8wgz88ereWn/7w05g0HMcB3RUN46ILJ9+ZB5yOanfN:XmJ3DaYlAN8er1nzTqrYN

Score
10/10
latam_generic_downloaderdiscoverypersistenceprivilege_escalation

Malware Config

Extracted

Family

latam_generic_downloader

C2

https://s7h3bdd733d.s3.sa-east-1.amazonaws.com/libeay32.criss

Targets

    • Target

      JaffaCakes118_ed3edf8fdb2cd2f027127f4fb1fe7019

    • Size

      264KB

    • MD5

      ed3edf8fdb2cd2f027127f4fb1fe7019

    • SHA1

      e876622ade868b5c8461b80a9b8e4961e9427b2e

    • SHA256

      ece2bea42a77b9c098899150a002e9f702cc7cf5b43bc8f674c61d5adaf905d3

    • SHA512

      051d9ff3bc18233ee3174113b566a1bbd653588b9070563f9627c51315cd0e39bc6151a92f5df91cc8c809cd021ae79ab43ac0b88013930f7da7864c68a10d42

    • SSDEEP

      3072:XmWqcL903DaYlA8wgz88ereWn/7w05g0HMcB3RUN46ILJ9+ZB5yOanfN:XmJ3DaYlAN8er1nzTqrYN

    Score
    6/10
    discoverypersistenceprivilege_escalation

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks