Overview

overview

7

Static

static

3

f6ebb39048...18.exe

windows7-x64

7

f6ebb39048...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f6ebb390486658cba3b8b3f7b4babd9e_JaffaCakes118

  • Size

    200KB

  • Sample

    240418-azew3ada48

  • MD5

    f6ebb390486658cba3b8b3f7b4babd9e

  • SHA1

    a5a30a39a4250d0d313ed160e46a38e4d6ea3636

  • SHA256

    70a89265d7af1531e4466558c5f19c3095a66892316f4b2c5d2d4275d1b3a949

  • SHA512

    bd7603b78a8bd550b4a616d13b3637bb132d1307e0d82c6fff207a1a5eaf8195b0eb236de2a8190916ddd4bbf0d729cd2cecb89f67cdab0d2dd401f11ca19517

  • SSDEEP

    3072:Kcv78rdMCuJNkQIbRiHfpGJ007ZBgM8gxHy+gXKq+Fnwpd3qLsRRlYm99M:KZVup2khY007Zl5v7pFnwrqOci9M

Score
7/10
persistenceupx

Malware Config

Targets

    • Target

      f6ebb390486658cba3b8b3f7b4babd9e_JaffaCakes118

    • Size

      200KB

    • MD5

      f6ebb390486658cba3b8b3f7b4babd9e

    • SHA1

      a5a30a39a4250d0d313ed160e46a38e4d6ea3636

    • SHA256

      70a89265d7af1531e4466558c5f19c3095a66892316f4b2c5d2d4275d1b3a949

    • SHA512

      bd7603b78a8bd550b4a616d13b3637bb132d1307e0d82c6fff207a1a5eaf8195b0eb236de2a8190916ddd4bbf0d729cd2cecb89f67cdab0d2dd401f11ca19517

    • SSDEEP

      3072:Kcv78rdMCuJNkQIbRiHfpGJ007ZBgM8gxHy+gXKq+Fnwpd3qLsRRlYm99M:KZVup2khY007Zl5v7pFnwrqOci9M

    Score
    7/10
    persistenceupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks