Overview

overview

10

Static

static

7

ef1627592f...18.exe

windows7-x64

7

ef1627592f...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ef1627592f381029d6e447b654550ede_JaffaCakes118

  • Size

    141KB

  • Sample

    240921-fcdclswamk

  • MD5

    ef1627592f381029d6e447b654550ede

  • SHA1

    a45e5a29f6c1e6adb10f4056de1162fcd17c1eb2

  • SHA256

    092824ad698ae9bce7d87a5d27c820b7f2a95f962d273a4ca7eaa264b4356bb5

  • SHA512

    8365750cd9199a62a5f486ce1a104afdc6940b051cdca19852854179c6fc552e9803e990946a85094f56f1600b3fa09427273fac8a1f4036f0bd400bf45d3f3a

  • SSDEEP

    3072:seq+JxWt8A3AqjXdU3C402GENxVKR9WDW:9q6xY8JkXW3CObcc

Score
10/10
discoveryevasionupx

Malware Config

Targets

    • Target

      ef1627592f381029d6e447b654550ede_JaffaCakes118

    • Size

      141KB

    • MD5

      ef1627592f381029d6e447b654550ede

    • SHA1

      a45e5a29f6c1e6adb10f4056de1162fcd17c1eb2

    • SHA256

      092824ad698ae9bce7d87a5d27c820b7f2a95f962d273a4ca7eaa264b4356bb5

    • SHA512

      8365750cd9199a62a5f486ce1a104afdc6940b051cdca19852854179c6fc552e9803e990946a85094f56f1600b3fa09427273fac8a1f4036f0bd400bf45d3f3a

    • SSDEEP

      3072:seq+JxWt8A3AqjXdU3C402GENxVKR9WDW:9q6xY8JkXW3CObcc

    Score
    10/10
    discoveryupxevasion

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks