Overview

overview

7

Static

static

7

eb1a6c8a84...18.exe

windows7-x64

7

eb1a6c8a84...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    eb1a6c8a847dac1349022011fb7ad5b4_JaffaCakes118

  • Size

    37KB

  • Sample

    240919-l4jllasfph

  • MD5

    eb1a6c8a847dac1349022011fb7ad5b4

  • SHA1

    541b65d816ee1edcd85c07c860c1e3d1adeb96de

  • SHA256

    c43c2d31ea71c92ec6d34035380d812fcee17609862d2b27b593a97a6de92fdc

  • SHA512

    6ee2795e1e7b078c51ba26a4f03db56d269fdd0a4ef98ad9cb5b135a953caeb20139745f931bc9a2a5e7a1b27e87fb09786b9ea160f2babfc532bf4dc8e4b10a

  • SSDEEP

    768:ioJD4TgEj+7QtDHiOm5i3OYr4Y39CdjvKwSVsRC86at3wgdrfgWP3nt7MAhxL/MG:9JET/j+k7iO4iX4EejwVNls1Cc3p3h/x

Score
7/10
defense_evasiondiscoveryupx

Malware Config

Targets

    • Target

      eb1a6c8a847dac1349022011fb7ad5b4_JaffaCakes118

    • Size

      37KB

    • MD5

      eb1a6c8a847dac1349022011fb7ad5b4

    • SHA1

      541b65d816ee1edcd85c07c860c1e3d1adeb96de

    • SHA256

      c43c2d31ea71c92ec6d34035380d812fcee17609862d2b27b593a97a6de92fdc

    • SHA512

      6ee2795e1e7b078c51ba26a4f03db56d269fdd0a4ef98ad9cb5b135a953caeb20139745f931bc9a2a5e7a1b27e87fb09786b9ea160f2babfc532bf4dc8e4b10a

    • SSDEEP

      768:ioJD4TgEj+7QtDHiOm5i3OYr4Y39CdjvKwSVsRC86at3wgdrfgWP3nt7MAhxL/MG:9JET/j+k7iO4iX4EejwVNls1Cc3p3h/x

    Score
    7/10
    defense_evasiondiscoveryupx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks