Overview

overview

10

Static

static

7

6faf1ebcce...18.exe

windows7-x64

10

6faf1ebcce...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6faf1ebcce24c6a25d3d534eb8b55979_JaffaCakes118

  • Size

    207KB

  • Sample

    240725-p966mashpd

  • MD5

    6faf1ebcce24c6a25d3d534eb8b55979

  • SHA1

    62acb0ec801d4bf210f437a65ae10b16fe962414

  • SHA256

    6958d497240bb6afde3d8108d18c2ae985342e9563428e7ddb532ede97ed8621

  • SHA512

    46a3464b0c14e19b938cf898712c575bb0cf6db31fbe9f10800c89307148ff68d2a095e9d1b0b4201c80cb9d3432fd3dc6cdb57ef79ebda1132dc0c238bcd3a9

  • SSDEEP

    6144:NdSfIrsmZ9BOuiIYNI7TYmUZ/ElE53CqZU5WpvqL:2It/iH0TYmllPevqL

Score
10/10
discoverypersistenceupx

Malware Config

Targets

    • Target

      6faf1ebcce24c6a25d3d534eb8b55979_JaffaCakes118

    • Size

      207KB

    • MD5

      6faf1ebcce24c6a25d3d534eb8b55979

    • SHA1

      62acb0ec801d4bf210f437a65ae10b16fe962414

    • SHA256

      6958d497240bb6afde3d8108d18c2ae985342e9563428e7ddb532ede97ed8621

    • SHA512

      46a3464b0c14e19b938cf898712c575bb0cf6db31fbe9f10800c89307148ff68d2a095e9d1b0b4201c80cb9d3432fd3dc6cdb57ef79ebda1132dc0c238bcd3a9

    • SSDEEP

      6144:NdSfIrsmZ9BOuiIYNI7TYmUZ/ElE53CqZU5WpvqL:2It/iH0TYmllPevqL

    Score
    10/10
    discoverypersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks