Overview

overview

10

Static

static

3

67a1ff3d1c...18.exe

windows7-x64

10

67a1ff3d1c...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    67a1ff3d1c8bea751873bb65b73f5593_JaffaCakes118

  • Size

    268KB

  • Sample

    240723-pv9m7szerm

  • MD5

    67a1ff3d1c8bea751873bb65b73f5593

  • SHA1

    db20d46fdeb196f9d7002b110766de255a6b3447

  • SHA256

    25bd8e127c4446c416322c79bee355cf39fcbad7c1c02144da86b02a21ead03f

  • SHA512

    8e3f41a4cef2bb1d2c30bdea8ee234b4753f7625a6c11ca37ec2823ca4c6f59db01f9611bac248f06154ef360788c5486be6d442f682b3470b9cd69bafba4e15

  • SSDEEP

    6144:xdUm3WQ6CvbpJv13woAdZoIBBm2lN/04DfuHOVTo/XcMAPsx:jUmmTibpJGrdZoIzH/04DfLVTo0O

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      67a1ff3d1c8bea751873bb65b73f5593_JaffaCakes118

    • Size

      268KB

    • MD5

      67a1ff3d1c8bea751873bb65b73f5593

    • SHA1

      db20d46fdeb196f9d7002b110766de255a6b3447

    • SHA256

      25bd8e127c4446c416322c79bee355cf39fcbad7c1c02144da86b02a21ead03f

    • SHA512

      8e3f41a4cef2bb1d2c30bdea8ee234b4753f7625a6c11ca37ec2823ca4c6f59db01f9611bac248f06154ef360788c5486be6d442f682b3470b9cd69bafba4e15

    • SSDEEP

      6144:xdUm3WQ6CvbpJv13woAdZoIBBm2lN/04DfuHOVTo/XcMAPsx:jUmmTibpJGrdZoIzH/04DfLVTo0O

    Score
    10/10
    evasionpersistenceupx

    • Modifies firewall policy service

      evasion

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks