Overview

overview

8

Static

static

7

efce35bfdf...18.exe

windows7-x64

8

efce35bfdf...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    efce35bfdf0ec34f2ad8606ec913e77f_JaffaCakes118

  • Size

    2.5MB

  • Sample

    240921-pr95kasfqr

  • MD5

    efce35bfdf0ec34f2ad8606ec913e77f

  • SHA1

    57f67d4d5f797e545292ca37597b6bcd0c82a091

  • SHA256

    9869ca517ef03ca89c2b762e54c6bc91796d7ee4e2747ea7d96611c34ffe176b

  • SHA512

    867ba7c5bc33b3237cfa26c40555eb6e400fa9f490f68b606653de68bf694af6adc05bc45af792cd2c36fc5e6d9e14ecebf6a8715e10e1d7ddad704f09cd24ec

  • SSDEEP

    49152:P08axSbLbb92Vz2e9ueqzXEfBAjnRv96TKwdNgZXl4Vw5fS:cQD52V98zgqjRsTKSgZP

Score
8/10
discoveryevasionpersistencethemida

Malware Config

Targets

    • Target

      efce35bfdf0ec34f2ad8606ec913e77f_JaffaCakes118

    • Size

      2.5MB

    • MD5

      efce35bfdf0ec34f2ad8606ec913e77f

    • SHA1

      57f67d4d5f797e545292ca37597b6bcd0c82a091

    • SHA256

      9869ca517ef03ca89c2b762e54c6bc91796d7ee4e2747ea7d96611c34ffe176b

    • SHA512

      867ba7c5bc33b3237cfa26c40555eb6e400fa9f490f68b606653de68bf694af6adc05bc45af792cd2c36fc5e6d9e14ecebf6a8715e10e1d7ddad704f09cd24ec

    • SSDEEP

      49152:P08axSbLbb92Vz2e9ueqzXEfBAjnRv96TKwdNgZXl4Vw5fS:cQD52V98zgqjRsTKSgZP

    Score
    8/10
    discoveryevasionpersistencethemida

    • Uses Session Manager for persistence

      Creates Session Manager registry key to run executable early in system boot.

      persistence

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks