Overview

overview

7

Static

static

7

4340f93c96...18.exe

windows7-x64

7

4340f93c96...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    4340f93c9694ced6e3cf1c4880858fe5_JaffaCakes118

  • Size

    1.4MB

  • Sample

    240713-zexc2swepq

  • MD5

    4340f93c9694ced6e3cf1c4880858fe5

  • SHA1

    7967e7e9fc951d7457e62a5d82baf68bd9c11f19

  • SHA256

    a1e2f9f4cf4699480dbcc7f560e6d6f2249d31d4dd1ec40ccdc0419216b2b71b

  • SHA512

    e21b567e4cb4e9a94f243f8f79b4b01d8767950356ce76652dcb1a481254956d68549610da1b2f353a461c768b7e3248e746008e03207b03d7d1cf163556390c

  • SSDEEP

    24576:w2Xl0vM8kkiwIGFX3eos6RKXehfMOOllAcLtGuHvWBH3E8XbxyoTy7iPYRP:wBM8GwDNuIYXehkdv1Y4O3E8rhyJP

Score
7/10
persistenceupxvmprotect

Malware Config

Targets

    • Target

      4340f93c9694ced6e3cf1c4880858fe5_JaffaCakes118

    • Size

      1.4MB

    • MD5

      4340f93c9694ced6e3cf1c4880858fe5

    • SHA1

      7967e7e9fc951d7457e62a5d82baf68bd9c11f19

    • SHA256

      a1e2f9f4cf4699480dbcc7f560e6d6f2249d31d4dd1ec40ccdc0419216b2b71b

    • SHA512

      e21b567e4cb4e9a94f243f8f79b4b01d8767950356ce76652dcb1a481254956d68549610da1b2f353a461c768b7e3248e746008e03207b03d7d1cf163556390c

    • SSDEEP

      24576:w2Xl0vM8kkiwIGFX3eos6RKXehfMOOllAcLtGuHvWBH3E8XbxyoTy7iPYRP:wBM8GwDNuIYXehkdv1Y4O3E8rhyJP

    Score
    7/10
    persistenceupxvmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks