Overview

overview

10

Static

static

3

2f4d8532a2...18.exe

windows7-x64

7

2f4d8532a2...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2f4d8532a232fb9f4d87d68a26b1b094_JaffaCakes118

  • Size

    83KB

  • Sample

    240709-g8kl8szfpr

  • MD5

    2f4d8532a232fb9f4d87d68a26b1b094

  • SHA1

    01a3dbd21d7780f4d7bce2e68a74f4e0b151b4ee

  • SHA256

    dbe8d13f7390d73bd5ca03eb74522c6ebfd93aa46659987c23aa93ef5e13193e

  • SHA512

    771b07de41fd746dc2d62a8ab96a12d442953ad97c886b37ef5bd64c3000018a5bbf54142a90430d4dc31bb92e2893c4996845f399bae459aa3241ad23b6c758

  • SSDEEP

    1536:YQxqcQu01TZlgkcgZYdfVCydmtXOd4fLJj3jWj:X/0zlgNgZY5VCpW4DJWj

Score
10/10
persistenceupx

Malware Config

Targets

    • Target

      2f4d8532a232fb9f4d87d68a26b1b094_JaffaCakes118

    • Size

      83KB

    • MD5

      2f4d8532a232fb9f4d87d68a26b1b094

    • SHA1

      01a3dbd21d7780f4d7bce2e68a74f4e0b151b4ee

    • SHA256

      dbe8d13f7390d73bd5ca03eb74522c6ebfd93aa46659987c23aa93ef5e13193e

    • SHA512

      771b07de41fd746dc2d62a8ab96a12d442953ad97c886b37ef5bd64c3000018a5bbf54142a90430d4dc31bb92e2893c4996845f399bae459aa3241ad23b6c758

    • SSDEEP

      1536:YQxqcQu01TZlgkcgZYdfVCydmtXOd4fLJj3jWj:X/0zlgNgZY5VCpW4DJWj

    Score
    10/10
    upxpersistence

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks