Overview

overview

8

Static

static

3

785c608c1b...18.exe

windows7-x64

8

785c608c1b...18.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    785c608c1b13155ecf6ee9e4e655a217_JaffaCakes118

  • Size

    489KB

  • Sample

    240727-qyz4lsveqc

  • MD5

    785c608c1b13155ecf6ee9e4e655a217

  • SHA1

    d31d940ffc0fcca86489ed2bffc61ad7aaf2a712

  • SHA256

    09a0df4265ab25ff561a3cec1dbe6fa3dab812b5fd08ff679de5376ae31daa30

  • SHA512

    fc090be86db39c53c956f41e9e97bbc0336d7ed286cfa3f06ad2d9c5cc3549aa540ed9552a3df5e15f344bf051e95be65f664af1051f85729313b2e313c1bd09

  • SSDEEP

    3072:dHuMOcSChBy3XP6GT50YkcD+0EHQgYgNUeTcOcRU69fH9cEl3:dHicSChoXt3i0EH9Umvufnl

Score
8/10
discoverypersistenceupx

Malware Config

Targets

    • Target

      785c608c1b13155ecf6ee9e4e655a217_JaffaCakes118

    • Size

      489KB

    • MD5

      785c608c1b13155ecf6ee9e4e655a217

    • SHA1

      d31d940ffc0fcca86489ed2bffc61ad7aaf2a712

    • SHA256

      09a0df4265ab25ff561a3cec1dbe6fa3dab812b5fd08ff679de5376ae31daa30

    • SHA512

      fc090be86db39c53c956f41e9e97bbc0336d7ed286cfa3f06ad2d9c5cc3549aa540ed9552a3df5e15f344bf051e95be65f664af1051f85729313b2e313c1bd09

    • SSDEEP

      3072:dHuMOcSChBy3XP6GT50YkcD+0EHQgYgNUeTcOcRU69fH9cEl3:dHicSChoXt3i0EH9Umvufnl

    Score
    8/10
    discoverypersistenceupx

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks