Overview

overview

8

Static

static

7

ac73857419...18.exe

windows7-x64

8

ac73857419...18.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    ac73857419566b8c73bebf9504807cfd_JaffaCakes118

  • Size

    183KB

  • Sample

    240819-y6yjrayakk

  • MD5

    ac73857419566b8c73bebf9504807cfd

  • SHA1

    7b213c2d78fe08babab7aec29ebf0c6422196d30

  • SHA256

    51562a917a02c13a67e36f1ff8c288ef9ab24332c5fd7a0996f07555595cb617

  • SHA512

    c49ee033552e8264eabaaebc113f2c03742ca8bab381893025fab3aa397827129d3e6b9c5e57d4171f685b898b3627aae5100f7f0327b4f509fcd17bf8a950f1

  • SSDEEP

    3072:EamFnQYUM6m3SP2sVSdEnfWZN3cbgonk9sX1qalYuhLJNdjQVVTuP5J85Vi9iqVT:Eazq3aipalYuhoao5sQkzK+H

Score
8/10
discoveryupx

Malware Config

Targets

    • Target

      ac73857419566b8c73bebf9504807cfd_JaffaCakes118

    • Size

      183KB

    • MD5

      ac73857419566b8c73bebf9504807cfd

    • SHA1

      7b213c2d78fe08babab7aec29ebf0c6422196d30

    • SHA256

      51562a917a02c13a67e36f1ff8c288ef9ab24332c5fd7a0996f07555595cb617

    • SHA512

      c49ee033552e8264eabaaebc113f2c03742ca8bab381893025fab3aa397827129d3e6b9c5e57d4171f685b898b3627aae5100f7f0327b4f509fcd17bf8a950f1

    • SSDEEP

      3072:EamFnQYUM6m3SP2sVSdEnfWZN3cbgonk9sX1qalYuhLJNdjQVVTuP5J85Vi9iqVT:Eazq3aipalYuhoao5sQkzK+H

    Score
    8/10
    discoveryupx

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks