Overview

overview

10

Static

static

7

dc61d58b65...18.exe

windows7-x64

10

dc61d58b65...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    dc61d58b65dbed835226b3047d9e9627_JaffaCakes118

  • Size

    34KB

  • Sample

    240912-reqw9sxhjf

  • MD5

    dc61d58b65dbed835226b3047d9e9627

  • SHA1

    96a4ea8b2da428338c562d740c3749215d61914c

  • SHA256

    dd552663ded841be53ab2a2e5f55a158909558c96685163887d51008cfa5ead7

  • SHA512

    ed0e614d875c83ecd68df26ee9b22c22d4b539bbdd3c58b733a67598d370e517754374658532862ceddfdf17485ce866898a635469fefb0d52f97b8415831464

  • SSDEEP

    768:sPTVngLKKX7loN9l4j9i/702Z76Hns0k1OCx00nT1n:sPp8le9KgTR8nsFEK

Score
10/10
discoverypersistenceupx

Malware Config

Targets

    • Target

      dc61d58b65dbed835226b3047d9e9627_JaffaCakes118

    • Size

      34KB

    • MD5

      dc61d58b65dbed835226b3047d9e9627

    • SHA1

      96a4ea8b2da428338c562d740c3749215d61914c

    • SHA256

      dd552663ded841be53ab2a2e5f55a158909558c96685163887d51008cfa5ead7

    • SHA512

      ed0e614d875c83ecd68df26ee9b22c22d4b539bbdd3c58b733a67598d370e517754374658532862ceddfdf17485ce866898a635469fefb0d52f97b8415831464

    • SSDEEP

      768:sPTVngLKKX7loN9l4j9i/702Z76Hns0k1OCx00nT1n:sPp8le9KgTR8nsFEK

    Score
    10/10
    discoverypersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks