Overview

overview

7

Static

static

7

ab5cd27398...18.exe

windows7-x64

7

ab5cd27398...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    ab5cd27398539b28a1e1cf3ef54edb31_JaffaCakes118

  • Size

    5.0MB

  • Sample

    240819-rnhx1ssdnr

  • MD5

    ab5cd27398539b28a1e1cf3ef54edb31

  • SHA1

    15ebc19d49be4e756f7cc1e96b876459ff95de3c

  • SHA256

    94766e2d76a4bafc0889e438aab0e05bdee2de1320905d53cd526ba678183a0d

  • SHA512

    b345370de6b3ee2e095eeaa7f3fd628a9465bf32e519b1536b3c29ea9f3aa28ddb7b8d3b396e3afcf90a15ba069866e1c97ec2e065fe259527110134ff71025d

  • SSDEEP

    98304:n+7YYGuC5Tp6/UqE9KWlCseQgnidWh1D1h3fxhZPsh:n4OJ5Tp6/S9Keh3gnU81phWh

Score
7/10
discoveryevasionpersistencethemida

Malware Config

Targets

    • Target

      ab5cd27398539b28a1e1cf3ef54edb31_JaffaCakes118

    • Size

      5.0MB

    • MD5

      ab5cd27398539b28a1e1cf3ef54edb31

    • SHA1

      15ebc19d49be4e756f7cc1e96b876459ff95de3c

    • SHA256

      94766e2d76a4bafc0889e438aab0e05bdee2de1320905d53cd526ba678183a0d

    • SHA512

      b345370de6b3ee2e095eeaa7f3fd628a9465bf32e519b1536b3c29ea9f3aa28ddb7b8d3b396e3afcf90a15ba069866e1c97ec2e065fe259527110134ff71025d

    • SSDEEP

      98304:n+7YYGuC5Tp6/UqE9KWlCseQgnidWh1D1h3fxhZPsh:n4OJ5Tp6/S9Keh3gnU81phWh

    Score
    7/10
    discoveryevasionpersistencethemida

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks