Overview

overview

10

Static

static

3

26adc37442...18.exe

windows7-x64

10

26adc37442...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    26adc37442f43dd3e1c06c26c3793a56_JaffaCakes118

  • Size

    4.0MB

  • Sample

    240704-3rqb2sydpe

  • MD5

    26adc37442f43dd3e1c06c26c3793a56

  • SHA1

    15d6486f8c6c5c767651d3016624025d2fb34da4

  • SHA256

    f8ae2e6e1e607e7734fd02871d0754d7236e6f6ed9bb501ad6ff5115e40c42c2

  • SHA512

    55d21803162d126d460f95dccb580b85725a209a367a9ba00d00a5057370985bbd9a77689d7d45efb4ce7cec3b74edcaecd33f4d9bba4c9f4e21c371a8cb3765

  • SSDEEP

    98304:MRhxs1zO9FSSVNSt0RzOtk0kCkBptwhBKB0F+w7:GxEO9gSLSt0Ryi0pkBp6rK21

Score
10/10
evasionpersistenceprivilege_escalation

Malware Config

Targets

    • Target

      26adc37442f43dd3e1c06c26c3793a56_JaffaCakes118

    • Size

      4.0MB

    • MD5

      26adc37442f43dd3e1c06c26c3793a56

    • SHA1

      15d6486f8c6c5c767651d3016624025d2fb34da4

    • SHA256

      f8ae2e6e1e607e7734fd02871d0754d7236e6f6ed9bb501ad6ff5115e40c42c2

    • SHA512

      55d21803162d126d460f95dccb580b85725a209a367a9ba00d00a5057370985bbd9a77689d7d45efb4ce7cec3b74edcaecd33f4d9bba4c9f4e21c371a8cb3765

    • SSDEEP

      98304:MRhxs1zO9FSSVNSt0RzOtk0kCkBptwhBKB0F+w7:GxEO9gSLSt0Ryi0pkBp6rK21

    Score
    10/10
    evasionpersistenceprivilege_escalation

    • Modifies WinLogon for persistence

      persistence

    • Modifies Windows Firewall

      evasion

    • Sets service image path in registry

      persistence

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

3
T1112

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks