Overview

overview

10

Static

static

7

3880ca7706...18.exe

windows7-x64

10

3880ca7706...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3880ca7706869ac27a222cd9999264af_JaffaCakes118

  • Size

    410KB

  • Sample

    240711-k3g6pssbkd

  • MD5

    3880ca7706869ac27a222cd9999264af

  • SHA1

    0159759add921aae85ef21d57ee6c4201017fe16

  • SHA256

    9a3498f594d05341417167964592c6b1935c7969009728bd22b481e0167c9d63

  • SHA512

    051e144770adb0b773454008e5e551133c7592a30705847b3cafa1531a9b8168f125be092151fef4214e7259eb06543dbc8c74164c7da7eb460766a37f308bb6

  • SSDEEP

    12288:qnNhuBoY8SorxgmA+nlvVloVks0ZoTFR4U:qPatCg7EPOVZmooU

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      3880ca7706869ac27a222cd9999264af_JaffaCakes118

    • Size

      410KB

    • MD5

      3880ca7706869ac27a222cd9999264af

    • SHA1

      0159759add921aae85ef21d57ee6c4201017fe16

    • SHA256

      9a3498f594d05341417167964592c6b1935c7969009728bd22b481e0167c9d63

    • SHA512

      051e144770adb0b773454008e5e551133c7592a30705847b3cafa1531a9b8168f125be092151fef4214e7259eb06543dbc8c74164c7da7eb460766a37f308bb6

    • SSDEEP

      12288:qnNhuBoY8SorxgmA+nlvVloVks0ZoTFR4U:qPatCg7EPOVZmooU

    Score
    10/10
    evasionpersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Adds policy Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks