Overview

overview

10

Static

static

1

b54f9e1476...18.jar

windows7-x64

1

b54f9e1476...18.jar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b54f9e14769eaf13499d8ae127f41b4f_JaffaCakes118

  • Size

    544KB

  • Sample

    240616-1eezfashpp

  • MD5

    b54f9e14769eaf13499d8ae127f41b4f

  • SHA1

    9a4efb26695fb617445d1906e891cecb2c603a77

  • SHA256

    a525e88006849f0a7eff3f9de0c95d6ad3f6e88cda918ebc0fae3d6b39549b2f

  • SHA512

    03b818222f244a4a67d3012dba145b71e6f5f7616e216b784c81c0254e8b5f3b40ba8ef252bb8b240f79b816d3b9ce4510c76df2754b9251f79641f840a4d08d

  • SSDEEP

    12288:BwZDOaeh4XFKNqFW74QP6oEtTYRp9Z1IXSr+8yhb+rNoWm:6t+41OMkEtTYRpf1cSQb4CT

Score
10/10
adwinddiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      b54f9e14769eaf13499d8ae127f41b4f_JaffaCakes118

    • Size

      544KB

    • MD5

      b54f9e14769eaf13499d8ae127f41b4f

    • SHA1

      9a4efb26695fb617445d1906e891cecb2c603a77

    • SHA256

      a525e88006849f0a7eff3f9de0c95d6ad3f6e88cda918ebc0fae3d6b39549b2f

    • SHA512

      03b818222f244a4a67d3012dba145b71e6f5f7616e216b784c81c0254e8b5f3b40ba8ef252bb8b240f79b816d3b9ce4510c76df2754b9251f79641f840a4d08d

    • SSDEEP

      12288:BwZDOaeh4XFKNqFW74QP6oEtTYRp9Z1IXSr+8yhb+rNoWm:6t+41OMkEtTYRpf1cSQb4CT

    Score
    10/10
    adwinddiscoveryevasionpersistencetrojan

    • AdWind

      A Java-based RAT family operated as malware-as-a-service.

      trojanadwind

    • UAC bypass

      evasiontrojan

    • Sets file execution options in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

4
T1112

File and Directory Permissions Modification

1
T1222

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks