Overview

overview

7

Static

static

7

823d0edf29...18.exe

windows7-x64

7

823d0edf29...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    823d0edf29da22cbb36a953afcc8f56d_JaffaCakes118

  • Size

    198KB

  • Sample

    240801-3ygcqayald

  • MD5

    823d0edf29da22cbb36a953afcc8f56d

  • SHA1

    025c9d1fa7698c91f97d4223a405a9dbe60a6af6

  • SHA256

    d37269370f21a8743dccfb07c3967e0a99a4f1f6b8cb26c3eddf04aba7010a5c

  • SHA512

    2688602234efebe1edbd5bfac2dfe548eda3ee03117876a10ce794362e1c52696d45ce6725951b57c760c246fa72ecdedb7ce540fee6f43c6fb6692244235c2a

  • SSDEEP

    1536:V8sCk3FzdoRESZtPt+WkKNcWvYexUyZz0/0H2FsooFKv/kxgGa7:+sC2xoRNnPodWvYmZz0cH2FsoovgGa7

Score
7/10
discoverypersistenceupx

Malware Config

Targets

    • Target

      823d0edf29da22cbb36a953afcc8f56d_JaffaCakes118

    • Size

      198KB

    • MD5

      823d0edf29da22cbb36a953afcc8f56d

    • SHA1

      025c9d1fa7698c91f97d4223a405a9dbe60a6af6

    • SHA256

      d37269370f21a8743dccfb07c3967e0a99a4f1f6b8cb26c3eddf04aba7010a5c

    • SHA512

      2688602234efebe1edbd5bfac2dfe548eda3ee03117876a10ce794362e1c52696d45ce6725951b57c760c246fa72ecdedb7ce540fee6f43c6fb6692244235c2a

    • SSDEEP

      1536:V8sCk3FzdoRESZtPt+WkKNcWvYexUyZz0/0H2FsooFKv/kxgGa7:+sC2xoRNnPodWvYmZz0cH2FsoovgGa7

    Score
    7/10
    discoverypersistenceupx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks