Overview

overview

10

Static

static

7

ef1e383f9e...18.exe

windows7-x64

10

ef1e383f9e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ef1e383f9e6bbd9468f73acfbd60d03f_JaffaCakes118

  • Size

    12KB

  • Sample

    240921-fq7tdawdrg

  • MD5

    ef1e383f9e6bbd9468f73acfbd60d03f

  • SHA1

    1616e1e046666d283259d41882aa2d5f602be4ec

  • SHA256

    958aefeb11c3c540a20f840031b201a2c66e524bb4a4ed8d9f4f17d76d6a4a85

  • SHA512

    99b46e64287b2ec036f6a12d2ce8d20160eafb0d4512ca5d976c7676234bf0a912f55ebf1fa0c2f75fd97ab77f2ec65b9f97ed0865aea88e2d21e44ef605b43c

  • SSDEEP

    192:7WsnGNS9NYmsRWecp1xmQEaez0jYN2HmSmQcR+hbBHA6hnTWL82xW7:BGs7GWecpvmQlaZEPXg6hnTWL82xW7

Score
10/10
discoverypersistenceupx

Malware Config

Targets

    • Target

      ef1e383f9e6bbd9468f73acfbd60d03f_JaffaCakes118

    • Size

      12KB

    • MD5

      ef1e383f9e6bbd9468f73acfbd60d03f

    • SHA1

      1616e1e046666d283259d41882aa2d5f602be4ec

    • SHA256

      958aefeb11c3c540a20f840031b201a2c66e524bb4a4ed8d9f4f17d76d6a4a85

    • SHA512

      99b46e64287b2ec036f6a12d2ce8d20160eafb0d4512ca5d976c7676234bf0a912f55ebf1fa0c2f75fd97ab77f2ec65b9f97ed0865aea88e2d21e44ef605b43c

    • SSDEEP

      192:7WsnGNS9NYmsRWecp1xmQEaez0jYN2HmSmQcR+hbBHA6hnTWL82xW7:BGs7GWecpvmQlaZEPXg6hnTWL82xW7

    Score
    10/10
    discoverypersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks