Overview

overview

10

Static

static

3

b8c280f8f0...18.exe

windows7-x64

10

b8c280f8f0...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b8c280f8f0dec8881261bd479786f641_JaffaCakes118

  • Size

    438KB

  • Sample

    240822-xmh5aavfpj

  • MD5

    b8c280f8f0dec8881261bd479786f641

  • SHA1

    5fd055bc0304ddb5028c1c1d67ff55b8a1fc1d28

  • SHA256

    db49e4ae7efbdd60c73db07241fbfe43770295fb862862ef046bb33e8b7c7675

  • SHA512

    4d147a477ec71a1422fbf4809c41c300a2f81b1528d0caf7fc5846ef3e7a499b4045c3af75f2452c40962836bb7accaf1b9ebb53dec2b65465ff203cfb1fb7ed

  • SSDEEP

    6144:DTOh4r+tQuHZITGEeiZbSBKHE9V4WBr14zTX/kPR8iRq1uE+VIvr:DFr+tQu0GEeiZb51IqDsJ8iRIuECIvr

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Targets

    • Target

      b8c280f8f0dec8881261bd479786f641_JaffaCakes118

    • Size

      438KB

    • MD5

      b8c280f8f0dec8881261bd479786f641

    • SHA1

      5fd055bc0304ddb5028c1c1d67ff55b8a1fc1d28

    • SHA256

      db49e4ae7efbdd60c73db07241fbfe43770295fb862862ef046bb33e8b7c7675

    • SHA512

      4d147a477ec71a1422fbf4809c41c300a2f81b1528d0caf7fc5846ef3e7a499b4045c3af75f2452c40962836bb7accaf1b9ebb53dec2b65465ff203cfb1fb7ed

    • SSDEEP

      6144:DTOh4r+tQuHZITGEeiZbSBKHE9V4WBr14zTX/kPR8iRq1uE+VIvr:DFr+tQu0GEeiZb51IqDsJ8iRIuECIvr

    Score
    10/10
    discoveryevasionpersistenceupx

    • Modifies firewall policy service

      evasion

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

1
T1064

Persistence

Boot or Logon Autostart Execution

3
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

5
T1112

Scripting

1
T1064

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks