Overview

overview

10

Static

static

7

e0ef6f0918...18.exe

windows7-x64

10

e0ef6f0918...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e0ef6f0918e52efaea280dac53989603_JaffaCakes118

  • Size

    396KB

  • Sample

    240914-yspppatckh

  • MD5

    e0ef6f0918e52efaea280dac53989603

  • SHA1

    133c07681b08f1e0e606cfdb075a9b7654f65ca8

  • SHA256

    4a521febae3f7300e9232613f86e396cb498bba34813dada818dd076b741fceb

  • SHA512

    12258e35f40c5f661688c02506879a77c603ed6370aa6c4f97a39a2a614877ca01d8a13814759520e1c1f6f5928f07debdf38c7be48cc7c5d62e8a1ce98f78f0

  • SSDEEP

    12288:Nbti6v7MUMBGiKva6AcWE6C/idBoTHOSDGP+f/n:ltiEMkiyZAcWE6rdGCSDGmfP

Score
10/10
discoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      e0ef6f0918e52efaea280dac53989603_JaffaCakes118

    • Size

      396KB

    • MD5

      e0ef6f0918e52efaea280dac53989603

    • SHA1

      133c07681b08f1e0e606cfdb075a9b7654f65ca8

    • SHA256

      4a521febae3f7300e9232613f86e396cb498bba34813dada818dd076b741fceb

    • SHA512

      12258e35f40c5f661688c02506879a77c603ed6370aa6c4f97a39a2a614877ca01d8a13814759520e1c1f6f5928f07debdf38c7be48cc7c5d62e8a1ce98f78f0

    • SSDEEP

      12288:Nbti6v7MUMBGiKva6AcWE6C/idBoTHOSDGP+f/n:ltiEMkiyZAcWE6rdGCSDGmfP

    Score
    10/10
    discoveryevasionpersistencetrojanupx

    • Modifies WinLogon for persistence

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Modifies WinLogon

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks