Overview

overview

8

Static

static

3

2eb99925af...18.exe

windows7-x64

8

2eb99925af...18.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    2eb99925af7da265e2a94ea0c77ebac4_JaffaCakes118

  • Size

    765KB

  • Sample

    240709-c9e1xsvdjc

  • MD5

    2eb99925af7da265e2a94ea0c77ebac4

  • SHA1

    cb88ffc62cf846a37fda3f3e2b854b32500320e8

  • SHA256

    14e8d19784dfdb6543a841b576e303e3ab1b842b243e79074302f35827e05829

  • SHA512

    3970e4e2ba7bd77562c010c5d174658cf5f1d2f9f4e890fc781d466d42549311e5bb8b27312c5e306a00b60f7ba466df6049e4588dc4f8b979ef865200fd9944

  • SSDEEP

    12288:M5OWzgmC0yPRRF1Jtyy2/csVWFnqfGBS2T/14tH7bm/sHWjXDyLukHUFC9N:MIW8mqvf2ESOqfy51UH7y/s2jTHkHUYX

Score
8/10
persistenceprivilege_escalationupx

Malware Config

Targets

    • Target

      2eb99925af7da265e2a94ea0c77ebac4_JaffaCakes118

    • Size

      765KB

    • MD5

      2eb99925af7da265e2a94ea0c77ebac4

    • SHA1

      cb88ffc62cf846a37fda3f3e2b854b32500320e8

    • SHA256

      14e8d19784dfdb6543a841b576e303e3ab1b842b243e79074302f35827e05829

    • SHA512

      3970e4e2ba7bd77562c010c5d174658cf5f1d2f9f4e890fc781d466d42549311e5bb8b27312c5e306a00b60f7ba466df6049e4588dc4f8b979ef865200fd9944

    • SSDEEP

      12288:M5OWzgmC0yPRRF1Jtyy2/csVWFnqfGBS2T/14tH7bm/sHWjXDyLukHUFC9N:MIW8mqvf2ESOqfy51UH7y/s2jTHkHUYX

    Score
    8/10
    persistenceprivilege_escalationupx

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks