13a2f7df8dffcea202ebf701f33dca8043755d105c16c08121a182ebc7b196a5 | Triage

Submit
Reports

Overview

overview

Static

static

7

216458a955...18.exe

windows7-x64

216458a955...18.exe

windows10-2004-x64

Sharing

General

Target

216458a955cf0bed88fbde7a603d5af7_JaffaCakes118
Size

498KB
Sample

240703-hab3wa1erg
MD5

216458a955cf0bed88fbde7a603d5af7
SHA1

e43d73c6a7e6f84b2cab11408bab4a8ef3f61c3b
SHA256

13a2f7df8dffcea202ebf701f33dca8043755d105c16c08121a182ebc7b196a5
SHA512

2290000e06e16b3bd0be0f38ea605e4da0c2580c5b518b4c65acc8b915a05ddbee0bfc411ec6bbf60815b049de61c9f4e8313ac140f6d793c1714baeaea8684d
SSDEEP

6144:GWZfec9EbXDk6RkQKDrG1VVE+Iznmy+g4+nmy+g4se/tnmy+g4BnOxf:3ZWtI6RkZu0tAtE8

Score

10^/10

evasion execution persistence upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

216458a955cf0bed88fbde7a603d5af7_JaffaCakes118.exe

Resource

win7-20240611-en

evasion execution persistence upx

windows7-x64

18 signatures

150 seconds

Behavioral task

behavioral2

Sample

216458a955cf0bed88fbde7a603d5af7_JaffaCakes118.exe

Resource

win10v2004-20240508-en

evasion execution persistence upx

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  216458a955cf0bed88fbde7a603d5af7_JaffaCakes118
- Size
  
  498KB
- MD5
  
  216458a955cf0bed88fbde7a603d5af7
- SHA1
  
  e43d73c6a7e6f84b2cab11408bab4a8ef3f61c3b
- SHA256
  
  13a2f7df8dffcea202ebf701f33dca8043755d105c16c08121a182ebc7b196a5
- SHA512
  
  2290000e06e16b3bd0be0f38ea605e4da0c2580c5b518b4c65acc8b915a05ddbee0bfc411ec6bbf60815b049de61c9f4e8313ac140f6d793c1714baeaea8684d
- SSDEEP
  
  6144:GWZfec9EbXDk6RkQKDrG1VVE+Iznmy+g4+nmy+g4se/tnmy+g4BnOxf:3ZWtI6RkZu0tAtE8
Score

10^/10

evasion execution persistence upx
- Disables service(s)
  evasion execution
- Modifies visibility of file extensions in Explorer
  evasion
- Blocks application from running via registry modification
  Adds application to list of disallowed applications.
  evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

evasionexecutionpersistenceupx

behavioral2

evasionexecutionpersistenceupx

© 2018-2024

Terms | Privacy