Overview

overview

7

Static

static

3

08545b4443...18.exe

windows7-x64

7

08545b4443...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118

  • Size

    3.4MB

  • Sample

    240620-wa9k2atfmp

  • MD5

    08545b44439c2869ba8c0b8a4d8f96fc

  • SHA1

    7be7630dffd313b939562ab98fa4f9d3f06cb531

  • SHA256

    d1c1067e4cfdf3c30d3f13eadce8a72bbf32317ee67939db7a4fcc04d2d2e0fb

  • SHA512

    4c74c75ead9e6d72665120e8f18b52a6f32ee1b5342d66d4773e1a103d3e07f834f7fc5ba4c1c89d5c7189ee3ea7894b7825b291b36d8a228ea62e24218c56b1

  • SSDEEP

    49152:jocuK7GiCs9h6oArnSIQ1zTRESF5+9u9jM5dgzhywgDjuHBjTkrHyUuTQf/I4GZS:nQlrS/Lmu9hN8juhjQS+I4GZKKQ

Score
7/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118

    • Size

      3.4MB

    • MD5

      08545b44439c2869ba8c0b8a4d8f96fc

    • SHA1

      7be7630dffd313b939562ab98fa4f9d3f06cb531

    • SHA256

      d1c1067e4cfdf3c30d3f13eadce8a72bbf32317ee67939db7a4fcc04d2d2e0fb

    • SHA512

      4c74c75ead9e6d72665120e8f18b52a6f32ee1b5342d66d4773e1a103d3e07f834f7fc5ba4c1c89d5c7189ee3ea7894b7825b291b36d8a228ea62e24218c56b1

    • SSDEEP

      49152:jocuK7GiCs9h6oArnSIQ1zTRESF5+9u9jM5dgzhywgDjuHBjTkrHyUuTQf/I4GZS:nQlrS/Lmu9hN8juhjQS+I4GZKKQ

    Score
    7/10
    evasionpersistenceupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Deletes itself

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks