Overview

overview

10

Static

static

3

fa32e23c0c...18.exe

windows7-x64

10

fa32e23c0c...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    fa32e23c0c10a3ccd768bd3fca6998ad_JaffaCakes118

  • Size

    608KB

  • Sample

    240419-nkzjtabd3s

  • MD5

    fa32e23c0c10a3ccd768bd3fca6998ad

  • SHA1

    e5787971432ebd460cb85469cc8812644cc620c4

  • SHA256

    9d8b046a3f047eec911cf8a82c1e79d5bfaaebe8b7613079b80777580c8ef5e1

  • SHA512

    bda8f01d43fdd377f9ffda70882472377bd3e3fd9fd9fee87ffd550e7448d51b9293f0a224912bcae2041739b1fe0ab20e7c1901aa9c76758eb30b5a53b93cbb

  • SSDEEP

    12288:hwBhGxE+OslnlLVyX36KAPlwXgEf3Ugsl8UwaTv+Vxm3/7Tg7kM:hE+TnhVs6fl0bMvcx2z

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      fa32e23c0c10a3ccd768bd3fca6998ad_JaffaCakes118

    • Size

      608KB

    • MD5

      fa32e23c0c10a3ccd768bd3fca6998ad

    • SHA1

      e5787971432ebd460cb85469cc8812644cc620c4

    • SHA256

      9d8b046a3f047eec911cf8a82c1e79d5bfaaebe8b7613079b80777580c8ef5e1

    • SHA512

      bda8f01d43fdd377f9ffda70882472377bd3e3fd9fd9fee87ffd550e7448d51b9293f0a224912bcae2041739b1fe0ab20e7c1901aa9c76758eb30b5a53b93cbb

    • SSDEEP

      12288:hwBhGxE+OslnlLVyX36KAPlwXgEf3Ugsl8UwaTv+Vxm3/7Tg7kM:hE+TnhVs6fl0bMvcx2z

    Score
    10/10
    evasionpersistence

    • Modifies firewall policy service

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks