c390e62943f6c3cd8a21a5aed7b9d8528b30cae4bad6a5ba26f817d9bbf68d5f | Triage

Submit
Reports

Overview

overview

Static

static

3

280c3da5ea...18.exe

windows7-x64

280c3da5ea...18.exe

windows10-2004-x64

Sharing

General

Target

280c3da5ea65c959067f8ab553037370_JaffaCakes118
Size

320KB
Sample

240706-letp9stfnq
MD5

280c3da5ea65c959067f8ab553037370
SHA1

7941c2b2118fd30c2b8c65a1beab08d9331203c9
SHA256

c390e62943f6c3cd8a21a5aed7b9d8528b30cae4bad6a5ba26f817d9bbf68d5f
SHA512

628bf2984f38a82cda34f4b1afbe6f1a810201a29b9ce2e0f6a9daee31b7a86fa60dd114888d3c0f77cb10d5a539b2cc0b255c29abeb58a13613f4fdc0447041
SSDEEP

6144:ym/o/vvofih8jWlw7WtoPkvVOfzUE8uoglOs5WY94/JzZwLZ5rLLVIqxE+1qg:5o/UWIkNOfzUEQgFGJNmjKqxE+1

Score

10^/10

evasion persistence trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

280c3da5ea65c959067f8ab553037370_JaffaCakes118.exe

Resource

win7-20240705-en

evasion persistence trojan upx

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

280c3da5ea65c959067f8ab553037370_JaffaCakes118.exe

Resource

win10v2004-20240704-en

evasion persistence trojan upx

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  280c3da5ea65c959067f8ab553037370_JaffaCakes118
- Size
  
  320KB
- MD5
  
  280c3da5ea65c959067f8ab553037370
- SHA1
  
  7941c2b2118fd30c2b8c65a1beab08d9331203c9
- SHA256
  
  c390e62943f6c3cd8a21a5aed7b9d8528b30cae4bad6a5ba26f817d9bbf68d5f
- SHA512
  
  628bf2984f38a82cda34f4b1afbe6f1a810201a29b9ce2e0f6a9daee31b7a86fa60dd114888d3c0f77cb10d5a539b2cc0b255c29abeb58a13613f4fdc0447041
- SSDEEP
  
  6144:ym/o/vvofih8jWlw7WtoPkvVOfzUE8uoglOs5WY94/JzZwLZ5rLLVIqxE+1qg:5o/UWIkNOfzUEQgFGJNmjKqxE+1
Score

10^/10

evasion persistence trojan upx
- Modifies WinLogon for persistence
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Modifies WinLogon
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojanupx

behavioral2

evasionpersistencetrojanupx

© 2018-2024

Terms | Privacy