Overview

overview

10

Static

static

3

23a34243d0...18.exe

windows7-x64

10

23a34243d0...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    23a34243d08629020da4d677d50a6024_JaffaCakes118

  • Size

    172KB

  • Sample

    240703-19s5jszhqf

  • MD5

    23a34243d08629020da4d677d50a6024

  • SHA1

    d9be095d6203d12f708d7e0db43773235314e9fe

  • SHA256

    92cc1f98316e197fbe21e8a5f10de76e3732755d5925fec8061e4eaa8ee8f39c

  • SHA512

    58955678759348186fc037cef932bd53de7eddceda1f791030e50cd2bc6b254ebbaf4795169703270458c862d3863f596cd9e60bb9c7349a2c0de46ce10c4b42

  • SSDEEP

    3072:FNZBPdUU0+wHkU/kk0DaTt1vhr3EcGW76LhU:FLJjQk0thhrUY74

Score
10/10
defense_evasionpersistenceupx

Malware Config

Targets

    • Target

      23a34243d08629020da4d677d50a6024_JaffaCakes118

    • Size

      172KB

    • MD5

      23a34243d08629020da4d677d50a6024

    • SHA1

      d9be095d6203d12f708d7e0db43773235314e9fe

    • SHA256

      92cc1f98316e197fbe21e8a5f10de76e3732755d5925fec8061e4eaa8ee8f39c

    • SHA512

      58955678759348186fc037cef932bd53de7eddceda1f791030e50cd2bc6b254ebbaf4795169703270458c862d3863f596cd9e60bb9c7349a2c0de46ce10c4b42

    • SSDEEP

      3072:FNZBPdUU0+wHkU/kk0DaTt1vhr3EcGW76LhU:FLJjQk0thhrUY74

    Score
    10/10
    defense_evasionpersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Impair Defenses: Safe Mode Boot

      defense_evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks