Overview

overview

8

Static

static

7

b798d815d8...18.exe

windows7-x64

8

b798d815d8...18.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    b798d815d86e70c411c995da0bede7fb_JaffaCakes118

  • Size

    123KB

  • Sample

    240822-pft9zayhnj

  • MD5

    b798d815d86e70c411c995da0bede7fb

  • SHA1

    350f6cb2fe2ccacd32faad2f04600903a3f9a687

  • SHA256

    642e1ae1ea69de7686b24649bdbd2b0818954863e4ec8691f7bd096f08fc4454

  • SHA512

    291384ab2086611ea9e03c740e6557e70496d8674b2428541debf64a410196c6c4c10a5e058e7a4ceaac11fb3cfaafc5bb2df0c9c5c9064bc93393999a544752

  • SSDEEP

    3072:OeSQ41MZrrOwzrq5Ss9eYfphfFQkUcot3EpeBWLLB:OVYrJrOSsRwcpT

Score
8/10
discoveryupx

Malware Config

Targets

    • Target

      b798d815d86e70c411c995da0bede7fb_JaffaCakes118

    • Size

      123KB

    • MD5

      b798d815d86e70c411c995da0bede7fb

    • SHA1

      350f6cb2fe2ccacd32faad2f04600903a3f9a687

    • SHA256

      642e1ae1ea69de7686b24649bdbd2b0818954863e4ec8691f7bd096f08fc4454

    • SHA512

      291384ab2086611ea9e03c740e6557e70496d8674b2428541debf64a410196c6c4c10a5e058e7a4ceaac11fb3cfaafc5bb2df0c9c5c9064bc93393999a544752

    • SSDEEP

      3072:OeSQ41MZrrOwzrq5Ss9eYfphfFQkUcot3EpeBWLLB:OVYrJrOSsRwcpT

    Score
    8/10
    discoveryupx

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks