Overview

overview

8

Static

static

5

fb1c9523c5...18.exe

windows7-x64

8

fb1c9523c5...18.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    fb1c9523c5d39b9993f253eabb729ecf_JaffaCakes118

  • Size

    66KB

  • Sample

    240927-3pb2msxhpe

  • MD5

    fb1c9523c5d39b9993f253eabb729ecf

  • SHA1

    dcf1e48fbdafd27c2f4cb5f2662417060a7e526f

  • SHA256

    0a949f3ca17adc14b13221a85519f2607e7413b00db422f38270b06588db0309

  • SHA512

    50db067186516b4fabe01165f7c1d3e24096b1f5d7acc181184b54a6e2d5108607aec628b3f4e1c8db10ae334f2712be39b30b31d6669df1e17468c1e978c5cd

  • SSDEEP

    1536:RxHo2Lb5ieiVNSp3nzkMYGc2R9eTYtOd:RxI2RUNSRzjPclEm

Score
8/10
discoverypersistenceupx

Malware Config

Targets

    • Target

      fb1c9523c5d39b9993f253eabb729ecf_JaffaCakes118

    • Size

      66KB

    • MD5

      fb1c9523c5d39b9993f253eabb729ecf

    • SHA1

      dcf1e48fbdafd27c2f4cb5f2662417060a7e526f

    • SHA256

      0a949f3ca17adc14b13221a85519f2607e7413b00db422f38270b06588db0309

    • SHA512

      50db067186516b4fabe01165f7c1d3e24096b1f5d7acc181184b54a6e2d5108607aec628b3f4e1c8db10ae334f2712be39b30b31d6669df1e17468c1e978c5cd

    • SSDEEP

      1536:RxHo2Lb5ieiVNSp3nzkMYGc2R9eTYtOd:RxI2RUNSRzjPclEm

    Score
    8/10
    discoverypersistenceupx

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks