Overview

overview

10

Static

static

3

257aecf4e0...18.exe

windows7-x64

10

257aecf4e0...18.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    257aecf4e0933d2a059ee83d3479e031_JaffaCakes118

  • Size

    47KB

  • Sample

    240704-lntrmaxala

  • MD5

    257aecf4e0933d2a059ee83d3479e031

  • SHA1

    105878ecb0731ed9abece5863b484a2e544ee533

  • SHA256

    fdfd07b5ff8800056b24642ef4b4df9f467b778e9b877c10ebaf4d22e03a931a

  • SHA512

    3d5425cd6f33950b24809a965b2429e37a7fa7c448b5f475578f857b92227a9d7b8eb727853b6b42a50324a6689a3545016480c6d20c2d2915953e5b770d39d8

  • SSDEEP

    768:/jBRXguzzKBA1pDjjgI8kXE0bj10ThhnvhXtllbykBe+SxmhaDSegooJ1vG+09nG://wsN1pDjik0Q10ThhntLlbykBWTSe0n

Score
10/10
evasionpersistencetrojanupx

Malware Config

Targets

    • Target

      257aecf4e0933d2a059ee83d3479e031_JaffaCakes118

    • Size

      47KB

    • MD5

      257aecf4e0933d2a059ee83d3479e031

    • SHA1

      105878ecb0731ed9abece5863b484a2e544ee533

    • SHA256

      fdfd07b5ff8800056b24642ef4b4df9f467b778e9b877c10ebaf4d22e03a931a

    • SHA512

      3d5425cd6f33950b24809a965b2429e37a7fa7c448b5f475578f857b92227a9d7b8eb727853b6b42a50324a6689a3545016480c6d20c2d2915953e5b770d39d8

    • SSDEEP

      768:/jBRXguzzKBA1pDjjgI8kXE0bj10ThhnvhXtllbykBe+SxmhaDSegooJ1vG+09nG://wsN1pDjik0Q10ThhntLlbykBWTSe0n

    Score
    10/10
    evasionpersistencetrojanupx

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Disables Task Manager via registry modification

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks