Overview

overview

10

Static

static

3

ea946af80d...18.exe

windows7-x64

10

ea946af80d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ea946af80dccaacc26212b8d7ae43582_JaffaCakes118

  • Size

    232KB

  • Sample

    240919-e1v2ws1dmr

  • MD5

    ea946af80dccaacc26212b8d7ae43582

  • SHA1

    f58ff48ab0af459e9cd4e8e590944f533a1bc0d4

  • SHA256

    2e2389303ae870a88c84423326dd63b89f13e48cef39f605fb5a1e15e6a31abf

  • SHA512

    53e77bfaf2f5c6eaa364d5285e06fc3e5b24444a31ab52c7f2bfdf072c5bf8db3b9621a1005bdcfe4f30b4d7abc4f6fa2c5c5d08123a91abc92d53584bbb5364

  • SSDEEP

    6144:8MKLL4LLLLLLLLLLLWMh7LfLuob9NXj5eXFhdhjGbtk8ZGqLLLLLLLLLLLLLTLLs:8K99NXj5eCGl

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Targets

    • Target

      ea946af80dccaacc26212b8d7ae43582_JaffaCakes118

    • Size

      232KB

    • MD5

      ea946af80dccaacc26212b8d7ae43582

    • SHA1

      f58ff48ab0af459e9cd4e8e590944f533a1bc0d4

    • SHA256

      2e2389303ae870a88c84423326dd63b89f13e48cef39f605fb5a1e15e6a31abf

    • SHA512

      53e77bfaf2f5c6eaa364d5285e06fc3e5b24444a31ab52c7f2bfdf072c5bf8db3b9621a1005bdcfe4f30b4d7abc4f6fa2c5c5d08123a91abc92d53584bbb5364

    • SSDEEP

      6144:8MKLL4LLLLLLLLLLLWMh7LfLuob9NXj5eXFhdhjGbtk8ZGqLLLLLLLLLLLLLTLLs:8K99NXj5eCGl

    Score
    10/10
    discoveryevasionpersistenceupx

    • Modifies firewall policy service

      evasion

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks