Overview

overview

7

Static

static

7

video-esmofet1432.scr

windows7-x64

7

video-esmofet1432.scr

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    bac1b7b721389bfb70056dca5fca9a6b_JaffaCakes118

  • Size

    404KB

  • Sample

    240823-htk5ws1bjb

  • MD5

    bac1b7b721389bfb70056dca5fca9a6b

  • SHA1

    1a2f061abcb5a835c72119938b66fa5d23bb7917

  • SHA256

    308c50f086e15bd9b6fb537890e713c7629a9563ca43237cc8077e37569feb7c

  • SHA512

    9d633ba27c8bfdcb668c02bc427cb979ae2901eb05a1f2072e780db51c045ebac8985eb2ff66885088388331a3d47fdda67627ad507ff68b3fd8f8c1c9594ea9

  • SSDEEP

    12288:G0FVoO+IhaYZUp+JGJZ7su1lxdkh2+FKejiYRrc:BH+IhrU57vlxdu2+FKejiUc

Score
7/10
discoverypersistenceupx

Malware Config

Targets

    • Target

      video-esmofet1432.scr

    • Size

      463KB

    • MD5

      cb1dcf41ec73b773025bf554dd147db8

    • SHA1

      81e2a560a6b66cd688bd6dfb8252862026d35071

    • SHA256

      e67deb335dd316f44fbf273b38ff4f854fc4a80e817251ddad37fb55638f60d0

    • SHA512

      f6973dab366f22b14ec8713cc4c0ab97215910acc872a46574db5e7b47515a0f45bffeec1d5ee05dfc1a9efe01585c5bba056e548e4241801603cb3d89def4ce

    • SSDEEP

      12288:oA6bf5Ud3rjdJzxVuy8WoUo/3pTSe1ixR:oA6tUdbj3z+qg/p+e1iP

    Score
    7/10
    discoverypersistenceupx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks