Overview

overview

10

Static

static

7

5da56436a7...18.exe

windows7-x64

10

5da56436a7...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5da56436a75e3e7fb0f818d7b7904353_JaffaCakes118

  • Size

    121KB

  • Sample

    240719-zs89rstbnd

  • MD5

    5da56436a75e3e7fb0f818d7b7904353

  • SHA1

    21768bad4d5746eb5ee4cdc28ef4dccb7242e4ce

  • SHA256

    3d4bb670b3d1f33b37dd4e93ebebe4fcbe83e576271f5eca22b1000f8b978ca4

  • SHA512

    0fcba3c7c80cd968ff8cf7be29bc5451485d68b1a2b56d7dad31716f624fa434fdd7780b3a9bafa75435a76f800a2e8e5b44de0410fd10d4b8ba4cb0daf85c39

  • SSDEEP

    3072:JEZ/W9g90MP4LYQz0fkns/iZFyjjBr8a6RrffBqe:JET2MPMziknhnyv+z0

Score
10/10
defense_evasionevasionpersistenceupx

Malware Config

Targets

    • Target

      5da56436a75e3e7fb0f818d7b7904353_JaffaCakes118

    • Size

      121KB

    • MD5

      5da56436a75e3e7fb0f818d7b7904353

    • SHA1

      21768bad4d5746eb5ee4cdc28ef4dccb7242e4ce

    • SHA256

      3d4bb670b3d1f33b37dd4e93ebebe4fcbe83e576271f5eca22b1000f8b978ca4

    • SHA512

      0fcba3c7c80cd968ff8cf7be29bc5451485d68b1a2b56d7dad31716f624fa434fdd7780b3a9bafa75435a76f800a2e8e5b44de0410fd10d4b8ba4cb0daf85c39

    • SSDEEP

      3072:JEZ/W9g90MP4LYQz0fkns/iZFyjjBr8a6RrffBqe:JET2MPMziknhnyv+z0

    Score
    10/10
    defense_evasionevasionpersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Impair Defenses: Safe Mode Boot

      defense_evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks