3a0fe4c9191543d2ce2a4bd4131261e2b61b5629feb609d7d13ab41435fbc846 | Triage

Submit
Reports

Overview

overview

Static

static

7

641c8c0710...18.exe

windows7-x64

641c8c0710...18.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

641c8c0710db45b09a0fde737c4ef747_JaffaCakes118
Size

906KB
Sample

240722-v3fb8aydnd
MD5

641c8c0710db45b09a0fde737c4ef747
SHA1

d425228aa773f1fa11e168a4d5d5947ad8c1633d
SHA256

3a0fe4c9191543d2ce2a4bd4131261e2b61b5629feb609d7d13ab41435fbc846
SHA512

a119650c5171a673cae55e2e3ef2318b976b73ee59e6e97f69d09b79a47ceb98951b25c0406d6d603ee5d6f7fca7289133070f1b824b18ce9f30faa98d31539f
SSDEEP

6144:GWZfec9EbXDk6RkQKW/UOPSe570Szp3irG1VVE+Ih/UOPSe570Szp37E2Ew6kulm:3ZWtI6RkPOB0JupOB07w6HTE

Score

10^/10

evasion execution persistence upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

641c8c0710db45b09a0fde737c4ef747_JaffaCakes118.exe

Resource

win7-20240704-en

evasion execution persistence upx

windows7-x64

18 signatures

150 seconds

Behavioral task

behavioral2

Sample

641c8c0710db45b09a0fde737c4ef747_JaffaCakes118.exe

Resource

win10v2004-20240709-en

evasion execution persistence upx

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  641c8c0710db45b09a0fde737c4ef747_JaffaCakes118
- Size
  
  906KB
- MD5
  
  641c8c0710db45b09a0fde737c4ef747
- SHA1
  
  d425228aa773f1fa11e168a4d5d5947ad8c1633d
- SHA256
  
  3a0fe4c9191543d2ce2a4bd4131261e2b61b5629feb609d7d13ab41435fbc846
- SHA512
  
  a119650c5171a673cae55e2e3ef2318b976b73ee59e6e97f69d09b79a47ceb98951b25c0406d6d603ee5d6f7fca7289133070f1b824b18ce9f30faa98d31539f
- SSDEEP
  
  6144:GWZfec9EbXDk6RkQKW/UOPSe570Szp3irG1VVE+Ih/UOPSe570Szp37E2Ew6kulm:3ZWtI6RkPOB0JupOB07w6HTE
Score

10^/10

evasion execution persistence upx
- Disables service(s)
  evasion execution
- Modifies visibility of file extensions in Explorer
  evasion
- Blocks application from running via registry modification
  Adds application to list of disallowed applications.
  evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

evasionexecutionpersistenceupx

behavioral2

evasionexecutionpersistenceupx

© 2018-2025

Terms | Privacy