Overview

overview

10

Static

static

7

6258999f46...18.exe

windows7-x64

10

6258999f46...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6258999f46ab05fc74eafc31df6e6145_JaffaCakes118

  • Size

    206KB

  • Sample

    240722-jk35sawhjj

  • MD5

    6258999f46ab05fc74eafc31df6e6145

  • SHA1

    3d3a773367ea8a453678e48da9bc7464b936f10f

  • SHA256

    23196395befa931a2861ad6163fe894b9560e74fb21570ea8bfa630adf404bbb

  • SHA512

    090517ba100c32f64af2844ecdd618312c4768b1cea2b874d6caa37cbf510a9996b7a6a843e73d6ab8a9847bcab8da8cec27d32aeaf5a03c84c45321d357dda5

  • SSDEEP

    3072:QPTpeXSg7MMNS6Ag1wAw5DK2GUdQ+Pm0V5Ge9jYD/flHyjIbXo3Kd32acF0B:Ug7vNSrunU6aVI6j6/NHyc7Y81cF0

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      6258999f46ab05fc74eafc31df6e6145_JaffaCakes118

    • Size

      206KB

    • MD5

      6258999f46ab05fc74eafc31df6e6145

    • SHA1

      3d3a773367ea8a453678e48da9bc7464b936f10f

    • SHA256

      23196395befa931a2861ad6163fe894b9560e74fb21570ea8bfa630adf404bbb

    • SHA512

      090517ba100c32f64af2844ecdd618312c4768b1cea2b874d6caa37cbf510a9996b7a6a843e73d6ab8a9847bcab8da8cec27d32aeaf5a03c84c45321d357dda5

    • SSDEEP

      3072:QPTpeXSg7MMNS6Ag1wAw5DK2GUdQ+Pm0V5Ge9jYD/flHyjIbXo3Kd32acF0B:Ug7vNSrunU6aVI6j6/NHyc7Y81cF0

    Score
    10/10
    evasionpersistenceupx

    • Modifies firewall policy service

      evasion

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks