Overview

overview

10

Static

static

3

8db2d34758...18.exe

windows7-x64

10

8db2d34758...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8db2d34758fea60aefba41091908044a_JaffaCakes118

  • Size

    455KB

  • Sample

    240812-hern5ayhrp

  • MD5

    8db2d34758fea60aefba41091908044a

  • SHA1

    852821cc542523334b2f8bf808c9b6d8dca8c26f

  • SHA256

    cfbd5fd83dc8e6f28082de45d28391071fdd72c394647551f7aa27b7997913a3

  • SHA512

    eaf139bccf5e6421fa9a6839ce39710180ed0fe0920918b87b8ecae92e7f40dfc1649ee04a41ff6caa73ddcd7bd4085da4d02ef0cbdb23140923ea21d9259bc9

  • SSDEEP

    12288:0op7yjGPpQiBTX5Rf0uGjC5mVK2rso9Mpa5K:BjvRf01+khA6MA

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Targets

    • Target

      8db2d34758fea60aefba41091908044a_JaffaCakes118

    • Size

      455KB

    • MD5

      8db2d34758fea60aefba41091908044a

    • SHA1

      852821cc542523334b2f8bf808c9b6d8dca8c26f

    • SHA256

      cfbd5fd83dc8e6f28082de45d28391071fdd72c394647551f7aa27b7997913a3

    • SHA512

      eaf139bccf5e6421fa9a6839ce39710180ed0fe0920918b87b8ecae92e7f40dfc1649ee04a41ff6caa73ddcd7bd4085da4d02ef0cbdb23140923ea21d9259bc9

    • SSDEEP

      12288:0op7yjGPpQiBTX5Rf0uGjC5mVK2rso9Mpa5K:BjvRf01+khA6MA

    Score
    10/10
    discoveryevasionpersistenceupx

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks