Overview

overview

8

Static

static

3

a3ce249447...18.exe

windows7-x64

8

a3ce249447...18.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    a3ce249447306ae720d72ce5afbacff2_JaffaCakes118

  • Size

    608KB

  • Sample

    240817-x2m2savenp

  • MD5

    a3ce249447306ae720d72ce5afbacff2

  • SHA1

    fbaabf458762e937ed86ed8655c58927cb46fb09

  • SHA256

    8b71ae902012eb85431fff1b9085a200153c6cf20a7fca7ad48768ee13a12c73

  • SHA512

    2faeab32acf15323c030c67941b6dbd24e9e544e33cc1490782b5607434c763a8799d100cc6748c0b8059833c5ce8b8dfdcf9b54c4159d458e7cf314e43bd3fc

  • SSDEEP

    12288:WRPIMWG6NcSkY94bSv9S1Zr/NKw4PsN7gJGQ7Ht:WRP1WG4zkY9oTr/N0KgFt

Score
8/10
discoverypersistenceupx

Malware Config

Targets

    • Target

      a3ce249447306ae720d72ce5afbacff2_JaffaCakes118

    • Size

      608KB

    • MD5

      a3ce249447306ae720d72ce5afbacff2

    • SHA1

      fbaabf458762e937ed86ed8655c58927cb46fb09

    • SHA256

      8b71ae902012eb85431fff1b9085a200153c6cf20a7fca7ad48768ee13a12c73

    • SHA512

      2faeab32acf15323c030c67941b6dbd24e9e544e33cc1490782b5607434c763a8799d100cc6748c0b8059833c5ce8b8dfdcf9b54c4159d458e7cf314e43bd3fc

    • SSDEEP

      12288:WRPIMWG6NcSkY94bSv9S1Zr/NKw4PsN7gJGQ7Ht:WRP1WG4zkY9oTr/N0KgFt

    Score
    8/10
    discoverypersistenceupx

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks