2b1cb463731d798783eb5786ef6eb5adcdfaaa77bc58ce090f8f5e8fac11acfe | Triage

Submit
Reports

Overview

overview

7

Static

static

7

d142e94f80...18.exe

windows7-x64

7

d142e94f80...18.exe

windows10-2004-x64

7

Sharing

General

Target

d142e94f80fd713e31e2f12d419627d8_JaffaCakes118
Size

321KB
Sample

240907-g1m3dsyeqn
MD5

d142e94f80fd713e31e2f12d419627d8
SHA1

670694de28ed2361b9f53d86ba128fe2281220d7
SHA256

2b1cb463731d798783eb5786ef6eb5adcdfaaa77bc58ce090f8f5e8fac11acfe
SHA512

f60624e8fe4ce9c2041fdec767341f0c7561a1976ee6458364a37cfffa01924cb54a0e2bc0233d7782ae6cab4a0464c421ad7a56bd2c0f456b15e60d56517bcd
SSDEEP

6144:wiLs+Lop94KLMZ4hD2tUfBxboPRY4aLxXGf1:wiQ+o9TYFtUJB9nVGf1

Score

7^/10

adware discovery evasion execution stealer trojan upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

d142e94f80fd713e31e2f12d419627d8_JaffaCakes118.exe

Resource

win7-20240903-en

adware discovery evasion execution stealer trojan upx

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

d142e94f80fd713e31e2f12d419627d8_JaffaCakes118.exe

Resource

win10v2004-20240802-en

adware discovery execution stealer upx

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  d142e94f80fd713e31e2f12d419627d8_JaffaCakes118
- Size
  
  321KB
- MD5
  
  d142e94f80fd713e31e2f12d419627d8
- SHA1
  
  670694de28ed2361b9f53d86ba128fe2281220d7
- SHA256
  
  2b1cb463731d798783eb5786ef6eb5adcdfaaa77bc58ce090f8f5e8fac11acfe
- SHA512
  
  f60624e8fe4ce9c2041fdec767341f0c7561a1976ee6458364a37cfffa01924cb54a0e2bc0233d7782ae6cab4a0464c421ad7a56bd2c0f456b15e60d56517bcd
- SSDEEP
  
  6144:wiLs+Lop94KLMZ4hD2tUfBxboPRY4aLxXGf1:wiQ+o9TYFtUJB9nVGf1
Score

7^/10

adware discovery evasion execution stealer trojan upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks whether UAC is enabled
  evasion trojan
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryevasionexecutionstealertrojanupx

behavioral2

adwarediscoveryexecutionstealerupx

© 2018-2025

Terms | Privacy