Overview

overview

7

Static

static

3

f7dfdf82fa...18.exe

windows7-x64

7

f7dfdf82fa...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f7dfdf82fa9bedf1442c446885fc8d6b_JaffaCakes118

  • Size

    559KB

  • Sample

    240418-m92j2abc45

  • MD5

    f7dfdf82fa9bedf1442c446885fc8d6b

  • SHA1

    72aa690361cf1e7a8669f5b1c8e5f224877287c1

  • SHA256

    3fd2b975ad9fc6327f0c0a3b29789605931c1c14964d607754611183aff1ee61

  • SHA512

    162f97d671396328ca8d22dd8adbd9d963688b0107142826f60d2b17313eff7f2b1f17491e398c98a8a7e79c1414caba1fc0b397cd96df74601bae0b133caefb

  • SSDEEP

    6144:7BtLHIAXJrEG9w+z9f3vMv92loae4DmA8sIMLnWXAqM65n1Gl25Zk/yxvU5Qr6XY:fHIAXxEG9VfE9AVfDWX5Gc5ZUyObN

Score
7/10
collectionpersistenceupx

Malware Config

Targets

    • Target

      f7dfdf82fa9bedf1442c446885fc8d6b_JaffaCakes118

    • Size

      559KB

    • MD5

      f7dfdf82fa9bedf1442c446885fc8d6b

    • SHA1

      72aa690361cf1e7a8669f5b1c8e5f224877287c1

    • SHA256

      3fd2b975ad9fc6327f0c0a3b29789605931c1c14964d607754611183aff1ee61

    • SHA512

      162f97d671396328ca8d22dd8adbd9d963688b0107142826f60d2b17313eff7f2b1f17491e398c98a8a7e79c1414caba1fc0b397cd96df74601bae0b133caefb

    • SSDEEP

      6144:7BtLHIAXJrEG9w+z9f3vMv92loae4DmA8sIMLnWXAqM65n1Gl25Zk/yxvU5Qr6XY:fHIAXxEG9VfE9AVfDWX5Gc5ZUyObN

    Score
    7/10
    collectionpersistenceupx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks