a85e6ff03ceef7238d26b8baffd5b02a285d39f4fd26e17b2e8237f736e076c2 | Triage

Submit
Reports

Overview

overview

Static

static

7

6212c299bb...18.exe

windows7-x64

6212c299bb...18.exe

windows10-2004-x64

Sharing

General

Target

6212c299bbb2810162dd4e6c1a804acf_JaffaCakes118
Size

191KB
Sample

240722-aypd4svgpn
MD5

6212c299bbb2810162dd4e6c1a804acf
SHA1

8ebc18c5a75b78ebbc39c238aba9ad22be41e945
SHA256

a85e6ff03ceef7238d26b8baffd5b02a285d39f4fd26e17b2e8237f736e076c2
SHA512

0f617f01f571109f159d2fa1ce51241c567ae775d6e1dfeaecd0b8c9c73149d4453f156c7a2cb06b8a7d79972533868febdaf231f044dbb591e991ec429833a1
SSDEEP

3072:Mf46HiAvEUVbxB3NgTBA7rQSeYWXKoTJbxD/PzJW4bR3Jz5O0w2XKLgQ:Mf46CAckdB321AXWXbTJ9D/PzJnbFt5O

Score

10^/10

evasion persistence privilege_escalation upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

6212c299bbb2810162dd4e6c1a804acf_JaffaCakes118.exe

Resource

win7-20240708-en

evasion persistence privilege_escalation upx

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

6212c299bbb2810162dd4e6c1a804acf_JaffaCakes118.exe

Resource

win10v2004-20240709-en

evasion persistence privilege_escalation upx

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  6212c299bbb2810162dd4e6c1a804acf_JaffaCakes118
- Size
  
  191KB
- MD5
  
  6212c299bbb2810162dd4e6c1a804acf
- SHA1
  
  8ebc18c5a75b78ebbc39c238aba9ad22be41e945
- SHA256
  
  a85e6ff03ceef7238d26b8baffd5b02a285d39f4fd26e17b2e8237f736e076c2
- SHA512
  
  0f617f01f571109f159d2fa1ce51241c567ae775d6e1dfeaecd0b8c9c73149d4453f156c7a2cb06b8a7d79972533868febdaf231f044dbb591e991ec429833a1
- SSDEEP
  
  3072:Mf46HiAvEUVbxB3NgTBA7rQSeYWXKoTJbxD/PzJW4bR3Jz5O0w2XKLgQ:Mf46CAckdB321AXWXbTJ9D/PzJnbFt5O
Score

10^/10

evasion persistence privilege_escalation upx
- Modifies firewall policy service
  evasion
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalationupx

behavioral2

evasionpersistenceprivilege_escalationupx

© 2018-2025

Terms | Privacy