Overview

overview

8

Static

static

7

76c8606a3d...18.exe

windows7-x64

8

76c8606a3d...18.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    76c8606a3d08b498eeb7d7f10c4cd56d_JaffaCakes118

  • Size

    123KB

  • Sample

    240727-dbvjdsvhla

  • MD5

    76c8606a3d08b498eeb7d7f10c4cd56d

  • SHA1

    36cee1dcc983dc4d56e7129d60473aa196012b5e

  • SHA256

    49e06f3f67059c50bee66aca2a7761daa3fa8ecd934f80a1e5f0c9a6016fb3d2

  • SHA512

    3d422c3b34b7cb140cbfef3681dcc544341fa8f95a742da03213e2a4a36addb5a2794fdeb56837729dd9a6f870dea4dcaabc5e8707d558ff48860a644d92a212

  • SSDEEP

    3072:OeSQ41MZrrOwzrq5Ss9eYfphfFQkUcot3EpeBWLLnh0HV:OVYrJrOSsRwcpdheV

Score
8/10
discoveryupx

Malware Config

Targets

    • Target

      76c8606a3d08b498eeb7d7f10c4cd56d_JaffaCakes118

    • Size

      123KB

    • MD5

      76c8606a3d08b498eeb7d7f10c4cd56d

    • SHA1

      36cee1dcc983dc4d56e7129d60473aa196012b5e

    • SHA256

      49e06f3f67059c50bee66aca2a7761daa3fa8ecd934f80a1e5f0c9a6016fb3d2

    • SHA512

      3d422c3b34b7cb140cbfef3681dcc544341fa8f95a742da03213e2a4a36addb5a2794fdeb56837729dd9a6f870dea4dcaabc5e8707d558ff48860a644d92a212

    • SSDEEP

      3072:OeSQ41MZrrOwzrq5Ss9eYfphfFQkUcot3EpeBWLLnh0HV:OVYrJrOSsRwcpdheV

    Score
    8/10
    discoveryupx

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks