Overview

overview

10

Static

static

7

a040033e4b...18.exe

windows7-x64

10

a040033e4b...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a040033e4b0591f46ec02d3bd2e57071_JaffaCakes118

  • Size

    344KB

  • Sample

    240816-2tfpyswbjn

  • MD5

    a040033e4b0591f46ec02d3bd2e57071

  • SHA1

    afe73adb0f0585ccf6df29eff7899555fe4e46af

  • SHA256

    e851ceae9e8a50dddb1fa88b19159cfab209e2b9738acd00d7011ed9e74748e8

  • SHA512

    bd3d0e34c7993baef72808ff7b1e5dae0cf3ae026c3c1e38816613f4944466550ac0ba1907549fc64cfa6713bf8c43cd5ac8d9fbf7c19194180ccf3304fcbe28

  • SSDEEP

    6144:vCxOET2PRA8A3bLeQh81uhTx8+WYbwWVJqjhLzgAmw7V0pm2vMtI6FSg952P+T8V:v1PO8MeQh81uhNmq+jhfgKBovMtIu2OW

Score
10/10
discoveryevasiontrojanupx

Malware Config

Targets

    • Target

      a040033e4b0591f46ec02d3bd2e57071_JaffaCakes118

    • Size

      344KB

    • MD5

      a040033e4b0591f46ec02d3bd2e57071

    • SHA1

      afe73adb0f0585ccf6df29eff7899555fe4e46af

    • SHA256

      e851ceae9e8a50dddb1fa88b19159cfab209e2b9738acd00d7011ed9e74748e8

    • SHA512

      bd3d0e34c7993baef72808ff7b1e5dae0cf3ae026c3c1e38816613f4944466550ac0ba1907549fc64cfa6713bf8c43cd5ac8d9fbf7c19194180ccf3304fcbe28

    • SSDEEP

      6144:vCxOET2PRA8A3bLeQh81uhTx8+WYbwWVJqjhLzgAmw7V0pm2vMtI6FSg952P+T8V:v1PO8MeQh81uhNmq+jhfgKBovMtIu2OW

    Score
    10/10
    discoveryevasiontrojanupx

    • UAC bypass

      evasiontrojan

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks whether UAC is enabled

      evasiontrojan

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks