Overview

overview

10

Static

static

3

edceed80e8...18.exe

windows7-x64

10

edceed80e8...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    edceed80e838bae3262b2c0b9a1d1c45_JaffaCakes118

  • Size

    384KB

  • Sample

    240920-rz72aa1gjb

  • MD5

    edceed80e838bae3262b2c0b9a1d1c45

  • SHA1

    3c622d0ca499d5e430b77e8ebf9a13f2a5bf9bf2

  • SHA256

    d6e821e4c976e8e76894feb1ca7379cbd2b0062108b98ec7a5a520b1b4d42aa1

  • SHA512

    756fd64c9250a1a49761e378ad19968250c5f7cb59f6686890924ed2fd903823169f62ba26b5e21ed5f3f3466b5caf3a43c64502ef47ecddfb57b1a88145e781

  • SSDEEP

    6144:AZUQoV86wYBQM/4ZVdNseBx0p9XbdVogK63rIzFjgf6dU:Tm61QMMpBx0DbdVO678G6dU

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Targets

    • Target

      edceed80e838bae3262b2c0b9a1d1c45_JaffaCakes118

    • Size

      384KB

    • MD5

      edceed80e838bae3262b2c0b9a1d1c45

    • SHA1

      3c622d0ca499d5e430b77e8ebf9a13f2a5bf9bf2

    • SHA256

      d6e821e4c976e8e76894feb1ca7379cbd2b0062108b98ec7a5a520b1b4d42aa1

    • SHA512

      756fd64c9250a1a49761e378ad19968250c5f7cb59f6686890924ed2fd903823169f62ba26b5e21ed5f3f3466b5caf3a43c64502ef47ecddfb57b1a88145e781

    • SSDEEP

      6144:AZUQoV86wYBQM/4ZVdNseBx0p9XbdVogK63rIzFjgf6dU:Tm61QMMpBx0DbdVO678G6dU

    Score
    10/10
    discoveryevasionpersistenceupx

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Enumerates processes with tasklist

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks