Overview

overview

8

Static

static

7

6fe8ff66ff...18.exe

windows7-x64

8

6fe8ff66ff...18.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6fe8ff66ffd242c7b9158eb162087736_JaffaCakes118

  • Size

    183KB

  • Sample

    240725-rht34asfrr

  • MD5

    6fe8ff66ffd242c7b9158eb162087736

  • SHA1

    8de4a966073f7ce9436125fff8d4e48b83acb600

  • SHA256

    34094b078a293ca487ae971ca8c23c2292a10389782d648765797dd67b59351b

  • SHA512

    b7b751c2e90fffc1f0e8189fcc27a752be9e00e8782f3d3274bc660d6538115b477d6d52dc38fd1dd98ea7396b13923be06d695972ae37271deb6dc4883a4591

  • SSDEEP

    3072:kamFnQYUM6m3SP2sVSdEnfWZN3cbgonk9sX1qalYuhLJNdjQVVTuP5J85Vi9iqV0:kazq3aipalYuhoao5sQkzAT

Score
8/10
discoveryupx

Malware Config

Targets

    • Target

      6fe8ff66ffd242c7b9158eb162087736_JaffaCakes118

    • Size

      183KB

    • MD5

      6fe8ff66ffd242c7b9158eb162087736

    • SHA1

      8de4a966073f7ce9436125fff8d4e48b83acb600

    • SHA256

      34094b078a293ca487ae971ca8c23c2292a10389782d648765797dd67b59351b

    • SHA512

      b7b751c2e90fffc1f0e8189fcc27a752be9e00e8782f3d3274bc660d6538115b477d6d52dc38fd1dd98ea7396b13923be06d695972ae37271deb6dc4883a4591

    • SSDEEP

      3072:kamFnQYUM6m3SP2sVSdEnfWZN3cbgonk9sX1qalYuhLJNdjQVVTuP5J85Vi9iqV0:kazq3aipalYuhoao5sQkzAT

    Score
    8/10
    discoveryupx

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks