Overview

overview

7

Static

static

3

49a0bdb50a...18.exe

windows7-x64

7

49a0bdb50a...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    49a0bdb50a9f22753fae5fa4688b788a_JaffaCakes118

  • Size

    32KB

  • Sample

    240715-nvc4kaxejf

  • MD5

    49a0bdb50a9f22753fae5fa4688b788a

  • SHA1

    24203af328e5d71a874b1569182e3806692ff1cb

  • SHA256

    4669b8660d87bf1e7c7b0d14a5458aee315c50862365d55ef1054ea53a7194b0

  • SHA512

    caeabbb7635995998d45577809d87f5c5fef28d49594fe5998808e650fc4ebeca06512e618356499b1e44ea038b0df11a58bc1f1ee7a4a44e914f41b4191a48c

  • SSDEEP

    384:CnR+rWpg/Smpc2AfUMjTtVkYCFJykE0bvmH4ciu1VNipbNtCGyF55U:g+rWpg/2sgTtVZ+mH4Ru7sTIb

Score
7/10
persistenceupx

Malware Config

Targets

    • Target

      49a0bdb50a9f22753fae5fa4688b788a_JaffaCakes118

    • Size

      32KB

    • MD5

      49a0bdb50a9f22753fae5fa4688b788a

    • SHA1

      24203af328e5d71a874b1569182e3806692ff1cb

    • SHA256

      4669b8660d87bf1e7c7b0d14a5458aee315c50862365d55ef1054ea53a7194b0

    • SHA512

      caeabbb7635995998d45577809d87f5c5fef28d49594fe5998808e650fc4ebeca06512e618356499b1e44ea038b0df11a58bc1f1ee7a4a44e914f41b4191a48c

    • SSDEEP

      384:CnR+rWpg/Smpc2AfUMjTtVkYCFJykE0bvmH4ciu1VNipbNtCGyF55U:g+rWpg/2sgTtVZ+mH4Ru7sTIb

    Score
    7/10
    persistenceupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks