Overview

overview

8

Static

static

3

6a99fb33ab...18.exe

windows7-x64

8

6a99fb33ab...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6a99fb33ab77db7ea2d65093469516bb_JaffaCakes118

  • Size

    113KB

  • Sample

    240724-hethqasgjj

  • MD5

    6a99fb33ab77db7ea2d65093469516bb

  • SHA1

    e80becdf41e04bbd465e165236db11bbd8797840

  • SHA256

    665fc372f524f1081817858821fb0eea61dff26b4915884a1328f95ee40f72b9

  • SHA512

    6a32586d4b730eea8f1e1d7563329c16c00d28fb65fd10d5ef4e98dc828bd873efdc3913c6280e76169e714aad5d5f9494607ced3a4cb3279a6a43d5a8c57f23

  • SSDEEP

    3072:mIb7bfLmVozmc+gRHhXScK/H6FENdZw1LmCrJ/SpSwYnfHjkBYA:mqPKoic+YicK/CENpQ0SRnfHjkGA

Score
8/10
discoveryupx

Malware Config

Targets

    • Target

      6a99fb33ab77db7ea2d65093469516bb_JaffaCakes118

    • Size

      113KB

    • MD5

      6a99fb33ab77db7ea2d65093469516bb

    • SHA1

      e80becdf41e04bbd465e165236db11bbd8797840

    • SHA256

      665fc372f524f1081817858821fb0eea61dff26b4915884a1328f95ee40f72b9

    • SHA512

      6a32586d4b730eea8f1e1d7563329c16c00d28fb65fd10d5ef4e98dc828bd873efdc3913c6280e76169e714aad5d5f9494607ced3a4cb3279a6a43d5a8c57f23

    • SSDEEP

      3072:mIb7bfLmVozmc+gRHhXScK/H6FENdZw1LmCrJ/SpSwYnfHjkBYA:mqPKoic+YicK/CENpQ0SRnfHjkGA

    Score
    8/10
    discoveryupx

    • Contacts a large (594) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks