Overview

overview

8

Static

static

5

fa54d61d86...18.exe

windows7-x64

8

fa54d61d86...18.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fa54d61d86d1576306972ecf9c73e2d4_JaffaCakes118

  • Size

    11KB

  • Sample

    240927-nqdvaszhqm

  • MD5

    fa54d61d86d1576306972ecf9c73e2d4

  • SHA1

    27c9f6fe4148bac5354a0b14d58721ed271f960a

  • SHA256

    7e0c4e1becffeee7b958ffb26291fb78f51df7d14f0127502154beb134af9307

  • SHA512

    8b8b252cd2ef21b4b4f98522343ce9aab4c03f7d46f94c35b8cb97f6bb1e6ec4a2930cdf8c9bf7e29d630fb450d50915bd822a742ac8276999ddfd004f33d1e6

  • SSDEEP

    192:XE4JgPu/PlfaC8NahI7yFJQT0V6RfCyG/B9ShZVuIaMAUaIGo7/r1Bclg:XE4WPOfarNa3JK0V5whGIahUaIGof8g

Score
8/10
discoverypersistenceprivilege_escalationupx

Malware Config

Targets

    • Target

      fa54d61d86d1576306972ecf9c73e2d4_JaffaCakes118

    • Size

      11KB

    • MD5

      fa54d61d86d1576306972ecf9c73e2d4

    • SHA1

      27c9f6fe4148bac5354a0b14d58721ed271f960a

    • SHA256

      7e0c4e1becffeee7b958ffb26291fb78f51df7d14f0127502154beb134af9307

    • SHA512

      8b8b252cd2ef21b4b4f98522343ce9aab4c03f7d46f94c35b8cb97f6bb1e6ec4a2930cdf8c9bf7e29d630fb450d50915bd822a742ac8276999ddfd004f33d1e6

    • SSDEEP

      192:XE4JgPu/PlfaC8NahI7yFJQT0V6RfCyG/B9ShZVuIaMAUaIGo7/r1Bclg:XE4WPOfarNa3JK0V5whGIahUaIGof8g

    Score
    8/10
    discoverypersistenceprivilege_escalationupx

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks