Overview

overview

10

Static

static

3

86296295f1...18.exe

windows7-x64

10

86296295f1...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    86296295f1186642a7150fdca3b51e74_JaffaCakes118

  • Size

    396KB

  • Sample

    240810-qbejdszgrl

  • MD5

    86296295f1186642a7150fdca3b51e74

  • SHA1

    887538d7b683c13e4d20dc42ed09926a8bde9f76

  • SHA256

    bcf915a1e8b1e69d83d0f605d2afa2cb19998d52dc3127656f66fa361e8b2124

  • SHA512

    0472b28b6cdccb1c5bdfcaa3b5c6f08f08cb57c6feea1e94f43b424dc87a9d34c62ebe888892367e04336880a8d127aaa9eb75650fba3a85b812468aa0633279

  • SSDEEP

    6144:J+4M+0Iew8nGRoMv/WB8R7js5PrG0+z3:J+Nqt/2G0

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Targets

    • Target

      86296295f1186642a7150fdca3b51e74_JaffaCakes118

    • Size

      396KB

    • MD5

      86296295f1186642a7150fdca3b51e74

    • SHA1

      887538d7b683c13e4d20dc42ed09926a8bde9f76

    • SHA256

      bcf915a1e8b1e69d83d0f605d2afa2cb19998d52dc3127656f66fa361e8b2124

    • SHA512

      0472b28b6cdccb1c5bdfcaa3b5c6f08f08cb57c6feea1e94f43b424dc87a9d34c62ebe888892367e04336880a8d127aaa9eb75650fba3a85b812468aa0633279

    • SSDEEP

      6144:J+4M+0Iew8nGRoMv/WB8R7js5PrG0+z3:J+Nqt/2G0

    Score
    10/10
    discoveryevasionpersistenceupx

    • Modifies firewall policy service

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks