Overview

overview

10

Static

static

7

ecb1017ccc...18.exe

windows7-x64

10

ecb1017ccc...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ecb1017ccc385dbee908f234f0bca35e_JaffaCakes118

  • Size

    106KB

  • Sample

    240411-fb5epsfg2t

  • MD5

    ecb1017ccc385dbee908f234f0bca35e

  • SHA1

    a31bcdb9705933d2a29dd82048bf5ae639e3b909

  • SHA256

    75f3a7f4dc2f0256b09f08383e9ed1d0736e89e763c585a7c2bec090fff06ebb

  • SHA512

    a52c2f0674587d15b0b67b8df64604337fdcd7486302aa0b44f783dd839caac5be24ee689da0195736e04e37a5995902c287436af09073699eda5f4297ca8578

  • SSDEEP

    1536:rjPzy7rAVb3n3gX72IEJ5NwE4G/a3hd+g/4gNxlfY:vPzyXANQX729D4G/aR34gLlw

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      ecb1017ccc385dbee908f234f0bca35e_JaffaCakes118

    • Size

      106KB

    • MD5

      ecb1017ccc385dbee908f234f0bca35e

    • SHA1

      a31bcdb9705933d2a29dd82048bf5ae639e3b909

    • SHA256

      75f3a7f4dc2f0256b09f08383e9ed1d0736e89e763c585a7c2bec090fff06ebb

    • SHA512

      a52c2f0674587d15b0b67b8df64604337fdcd7486302aa0b44f783dd839caac5be24ee689da0195736e04e37a5995902c287436af09073699eda5f4297ca8578

    • SSDEEP

      1536:rjPzy7rAVb3n3gX72IEJ5NwE4G/a3hd+g/4gNxlfY:vPzyXANQX729D4G/aR34gLlw

    Score
    10/10
    evasionpersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks