Overview

overview

8

Static

static

7

82e98a5990...18.exe

windows7-x64

8

82e98a5990...18.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    82e98a599034683fa7f7be43cbd88050_JaffaCakes118

  • Size

    123KB

  • Sample

    240802-d9tdzsyenc

  • MD5

    82e98a599034683fa7f7be43cbd88050

  • SHA1

    a39cf08a50c043ffe14a38e123416061427233ed

  • SHA256

    a0821a9f644e723533cf8d6bcaf6bb4adc348d8b6c41af13be2428c36970facd

  • SHA512

    873fa8455e29ba3046692732c857771b1d0392bb219890118fd1b000b2143f15a8360808fc962b93cbc6f3e474c76cadc1e1438b8e9a7cc12dc889bc8aa95db2

  • SSDEEP

    3072:OeSQ41MZrrOwzrq5Ss9eYfphfFQkUcot3EpeBWLLb0uuh:OVYrJrOSsRwcpJ0T

Score
8/10
discoveryupx

Malware Config

Targets

    • Target

      82e98a599034683fa7f7be43cbd88050_JaffaCakes118

    • Size

      123KB

    • MD5

      82e98a599034683fa7f7be43cbd88050

    • SHA1

      a39cf08a50c043ffe14a38e123416061427233ed

    • SHA256

      a0821a9f644e723533cf8d6bcaf6bb4adc348d8b6c41af13be2428c36970facd

    • SHA512

      873fa8455e29ba3046692732c857771b1d0392bb219890118fd1b000b2143f15a8360808fc962b93cbc6f3e474c76cadc1e1438b8e9a7cc12dc889bc8aa95db2

    • SSDEEP

      3072:OeSQ41MZrrOwzrq5Ss9eYfphfFQkUcot3EpeBWLLb0uuh:OVYrJrOSsRwcpJ0T

    Score
    8/10
    discoveryupx

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks