Overview

overview

7

Static

static

7

f9ab19bbd5...18.exe

windows7-x64

7

f9ab19bbd5...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    f9ab19bbd5ab13cfb1eb51c9befe97f6_JaffaCakes118

  • Size

    191KB

  • Sample

    240419-gw8tasaf38

  • MD5

    f9ab19bbd5ab13cfb1eb51c9befe97f6

  • SHA1

    e6f56ce8e2a357796607d7afe05f570908563de0

  • SHA256

    9b6749b7f8f90bdcb1a137eae000ef4eecc462300e5f29f2db1161060f52bba2

  • SHA512

    578f458d4bc72d6227fe10ac98694c5a8621c2f29dc2a13ea95218ff5775cb9794a98a2535e543cf524fbdd349f9562105b316b6ca2cd920af2cae3d58bfbeed

  • SSDEEP

    3072:pl5gfJ2JYejLf14G2k3k9uNgTWzG+3QhCDVvpC2dIu6JBy5oLKgd8feRg8NFm7WQ:pl2fJcFf52ntTYf3Qhcw53BDdAee8Ned

Score
7/10
persistenceupx

Malware Config

Targets

    • Target

      f9ab19bbd5ab13cfb1eb51c9befe97f6_JaffaCakes118

    • Size

      191KB

    • MD5

      f9ab19bbd5ab13cfb1eb51c9befe97f6

    • SHA1

      e6f56ce8e2a357796607d7afe05f570908563de0

    • SHA256

      9b6749b7f8f90bdcb1a137eae000ef4eecc462300e5f29f2db1161060f52bba2

    • SHA512

      578f458d4bc72d6227fe10ac98694c5a8621c2f29dc2a13ea95218ff5775cb9794a98a2535e543cf524fbdd349f9562105b316b6ca2cd920af2cae3d58bfbeed

    • SSDEEP

      3072:pl5gfJ2JYejLf14G2k3k9uNgTWzG+3QhCDVvpC2dIu6JBy5oLKgd8feRg8NFm7WQ:pl2fJcFf52ntTYf3Qhcw53BDdAee8Ned

    Score
    7/10
    persistenceupx

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks