Overview

overview

10

Static

static

7

c7ec373911...18.exe

windows7-x64

10

c7ec373911...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c7ec37391178150012ae735dc3abee6d_JaffaCakes118

  • Size

    263KB

  • Sample

    240829-asww1avand

  • MD5

    c7ec37391178150012ae735dc3abee6d

  • SHA1

    345183c486b0804fcebdbe3c3bc29b904428b321

  • SHA256

    8f4a57ee6a05931d82a004b550da1a74aa7fd8e304187ad4a2a12d528f3a675b

  • SHA512

    821e0cb4e5b507d634a2e77f559444e32406b29b2622c1fa963f9c8ef791f88284e451ed080e48046665cda667b017828b75c7f491b0bbb7ad1861f4bc9709b0

  • SSDEEP

    6144:ZQw50E5dmhLlCVb2UkV2kLJglqQbIjrzAws8d1x:e5mwhls6UkPLipbw0wp

Score
10/10
discoverypersistenceupx

Malware Config

Targets

    • Target

      c7ec37391178150012ae735dc3abee6d_JaffaCakes118

    • Size

      263KB

    • MD5

      c7ec37391178150012ae735dc3abee6d

    • SHA1

      345183c486b0804fcebdbe3c3bc29b904428b321

    • SHA256

      8f4a57ee6a05931d82a004b550da1a74aa7fd8e304187ad4a2a12d528f3a675b

    • SHA512

      821e0cb4e5b507d634a2e77f559444e32406b29b2622c1fa963f9c8ef791f88284e451ed080e48046665cda667b017828b75c7f491b0bbb7ad1861f4bc9709b0

    • SSDEEP

      6144:ZQw50E5dmhLlCVb2UkV2kLJglqQbIjrzAws8d1x:e5mwhls6UkPLipbw0wp

    Score
    10/10
    discoverypersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks