General

  • Target

    JaffaCakes118_8a37689689c2c8072ce71dc9eaee9278

  • Size

    512KB

  • Sample

    250328-btpdzssnw5

  • MD5

    8a37689689c2c8072ce71dc9eaee9278

  • SHA1

    9f4b5397777e2740b9c42f5df71eeb143854dd0a

  • SHA256

    a8b7dd0803b23353719c57aa2a57b6124e5aceb16da43b803b146f4e28a1f921

  • SHA512

    d30f59e78c4134770d16ebb8e56d280e21dd221fa43b4a9b604e438b0f3a67d2ec86dae029509b94e5e5b64d92c64f71df6b66643e034384df5b5f8158930191

  • SSDEEP

    12288:gQMiG+2gef5x/xQTB2OfDKC7WgcURfMMMMM2MMMMM:gQ0+29VgfDnKwRfMMMMM2MMMMM

Malware Config

Targets

    • Target

      JaffaCakes118_8a37689689c2c8072ce71dc9eaee9278

    • Size

      512KB

    • MD5

      8a37689689c2c8072ce71dc9eaee9278

    • SHA1

      9f4b5397777e2740b9c42f5df71eeb143854dd0a

    • SHA256

      a8b7dd0803b23353719c57aa2a57b6124e5aceb16da43b803b146f4e28a1f921

    • SHA512

      d30f59e78c4134770d16ebb8e56d280e21dd221fa43b4a9b604e438b0f3a67d2ec86dae029509b94e5e5b64d92c64f71df6b66643e034384df5b5f8158930191

    • SSDEEP

      12288:gQMiG+2gef5x/xQTB2OfDKC7WgcURfMMMMM2MMMMM:gQ0+29VgfDnKwRfMMMMM2MMMMM

    • Modifies WinLogon for persistence

    • Pykspa

      Pykspa is a worm spreads via Skype uses DGA and it's written in C++.

    • Pykspa family

    • Detect Pykspa worm

    • Adds policy Run key to start application

    • Blocklisted process makes network request

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Disables RegEdit via registry modification

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Impair Defenses: Safe Mode Boot

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Hijack Execution Flow: Executable Installer File Permissions Weakness

      Possible Turn off User Account Control's privilege elevation for standard users.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks