Overview

overview

7

Static

static

3

61e8c4bb72...18.exe

windows7-x64

7

61e8c4bb72...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    61e8c4bb727a5bafcecf3c1b20d789b4_JaffaCakes118

  • Size

    308KB

  • Sample

    240721-3qxpqstarr

  • MD5

    61e8c4bb727a5bafcecf3c1b20d789b4

  • SHA1

    a0d53dd91865e34d6c0215faaac4b42697c739d5

  • SHA256

    cdb37c750f2ddddf5e0c536c88d179c93012088c7a1be5c82ca4fcc5e4a08b5a

  • SHA512

    ab97f874079a03b30b68fb6bd42e9f4d703e3623959c148977efe0f3e6e567ba7cd8e245b1f1c7b00a25480bae072519a70a01d6589d97a7e346e3f475bbea5d

  • SSDEEP

    3072:+kQqDrknpea1/J4ad2/4MTxqCsmt9qTh9ukOQXfr5XsE+tttc8i/zavA1zF03g9O:+kQRx7Q6mqTc0pYty8i/zaeW+jExJd

Score
7/10
persistence

Malware Config

Targets

    • Target

      61e8c4bb727a5bafcecf3c1b20d789b4_JaffaCakes118

    • Size

      308KB

    • MD5

      61e8c4bb727a5bafcecf3c1b20d789b4

    • SHA1

      a0d53dd91865e34d6c0215faaac4b42697c739d5

    • SHA256

      cdb37c750f2ddddf5e0c536c88d179c93012088c7a1be5c82ca4fcc5e4a08b5a

    • SHA512

      ab97f874079a03b30b68fb6bd42e9f4d703e3623959c148977efe0f3e6e567ba7cd8e245b1f1c7b00a25480bae072519a70a01d6589d97a7e346e3f475bbea5d

    • SSDEEP

      3072:+kQqDrknpea1/J4ad2/4MTxqCsmt9qTh9ukOQXfr5XsE+tttc8i/zavA1zF03g9O:+kQRx7Q6mqTc0pYty8i/zaeW+jExJd

    Score
    7/10
    persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks