ad4abf2dcc43c49945af78ce5a425e9d265e779fd90960ecb41b252dc0a746e7 | Triage

Submit
Reports

Overview

overview

Static

static

7

60516a2801...18.exe

windows7-x64

60516a2801...18.exe

windows10-2004-x64

Sharing

General

Target

60516a2801993939baf463a86659bc4c_JaffaCakes118
Size

2.8MB
Sample

240720-2xf5ws1cpr
MD5

60516a2801993939baf463a86659bc4c
SHA1

a4a476a980b98aba81aa2ab89ff9be4c4fa0718a
SHA256

ad4abf2dcc43c49945af78ce5a425e9d265e779fd90960ecb41b252dc0a746e7
SHA512

5d8d124bb0d845db4b3c56bf23d4ec401c151d747ae8d18fd5e5a820b9d2918ee23907746ac635daed806d89583723644b3d791923b25c334bf6cb75c6e2b7f7
SSDEEP

49152:Yy8NKT/yqCvL/r/R/wdhqCQDkYOMwwnMb4PmyVZ:na1P5odh19YOXwnS4rVZ

Score

10^/10

evasion execution persistence upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

60516a2801993939baf463a86659bc4c_JaffaCakes118.exe

Resource

win7-20240708-en

evasion execution persistence upx

windows7-x64

18 signatures

150 seconds

Behavioral task

behavioral2

Sample

60516a2801993939baf463a86659bc4c_JaffaCakes118.exe

Resource

win10v2004-20240709-en

evasion execution persistence upx

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  60516a2801993939baf463a86659bc4c_JaffaCakes118
- Size
  
  2.8MB
- MD5
  
  60516a2801993939baf463a86659bc4c
- SHA1
  
  a4a476a980b98aba81aa2ab89ff9be4c4fa0718a
- SHA256
  
  ad4abf2dcc43c49945af78ce5a425e9d265e779fd90960ecb41b252dc0a746e7
- SHA512
  
  5d8d124bb0d845db4b3c56bf23d4ec401c151d747ae8d18fd5e5a820b9d2918ee23907746ac635daed806d89583723644b3d791923b25c334bf6cb75c6e2b7f7
- SSDEEP
  
  49152:Yy8NKT/yqCvL/r/R/wdhqCQDkYOMwwnMb4PmyVZ:na1P5odh19YOXwnS4rVZ
Score

10^/10

evasion execution persistence upx
- Disables service(s)
  evasion execution
- Modifies visibility of file extensions in Explorer
  evasion
- Blocks application from running via registry modification
  Adds application to list of disallowed applications.
  evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

evasionexecutionpersistenceupx

behavioral2

evasionexecutionpersistenceupx

© 2018-2025

Terms | Privacy