Overview

overview

8

Static

static

7

86cf96a102...18.exe

windows7-x64

8

86cf96a102...18.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    86cf96a102709afda15710cfbfd00019_JaffaCakes118

  • Size

    13KB

  • Sample

    240810-t1cyms1hmh

  • MD5

    86cf96a102709afda15710cfbfd00019

  • SHA1

    deca5a44083ffb68eb2b7f87afb6eacbd364fd3c

  • SHA256

    bd3028764d71a2b618020c93efc84bf3254587063e0037d6e667b81f3697274d

  • SHA512

    816138e7fcdb2632c92ecf3a62a978ddd97e9343202477053069ddb6dd82bba80ab10c8769068c0ce697973194c8cf537d78e086d3a188021d8fd9a584975f8d

  • SSDEEP

    384:peoiXE6cletE9EijfZETgknvJ4YA0MuxikDg:ViU19EiZ+gkvOYldw

Score
8/10
discoverypersistenceprivilege_escalationupx

Malware Config

Targets

    • Target

      86cf96a102709afda15710cfbfd00019_JaffaCakes118

    • Size

      13KB

    • MD5

      86cf96a102709afda15710cfbfd00019

    • SHA1

      deca5a44083ffb68eb2b7f87afb6eacbd364fd3c

    • SHA256

      bd3028764d71a2b618020c93efc84bf3254587063e0037d6e667b81f3697274d

    • SHA512

      816138e7fcdb2632c92ecf3a62a978ddd97e9343202477053069ddb6dd82bba80ab10c8769068c0ce697973194c8cf537d78e086d3a188021d8fd9a584975f8d

    • SSDEEP

      384:peoiXE6cletE9EijfZETgknvJ4YA0MuxikDg:ViU19EiZ+gkvOYldw

    Score
    8/10
    discoverypersistenceprivilege_escalationupx

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks