Overview

overview

10

Static

static

3

01e8c2ffc1...18.exe

windows7-x64

7

01e8c2ffc1...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    01e8c2ffc182c1e9c5e77f9c7df11ef6_JaffaCakes118

  • Size

    79KB

  • Sample

    240930-r8q45a1crm

  • MD5

    01e8c2ffc182c1e9c5e77f9c7df11ef6

  • SHA1

    816ef8561b608b5ab11862615fa2ee5866107bf1

  • SHA256

    db5efedcf343d8356bfd6bdd41719f7c1f8ee994060c9aae44da1cdd672ec6df

  • SHA512

    9d3c5c9bfd1aefa85838f6fb60ff4d11f98773d072ac2c5cd2bd7b1590025c6defaa226bd93905d2f693c9437015c7f32066125398e4b9d03ad3a74e33dce334

  • SSDEEP

    1536:nQxqcQu0iQ0KsgFWq/fpZl9c4QFABNitT2xLoxqxSnQ:Q/030KtFpBZnc4IABNhxLVUnQ

Score
10/10
discoverypersistenceupx

Malware Config

Targets

    • Target

      01e8c2ffc182c1e9c5e77f9c7df11ef6_JaffaCakes118

    • Size

      79KB

    • MD5

      01e8c2ffc182c1e9c5e77f9c7df11ef6

    • SHA1

      816ef8561b608b5ab11862615fa2ee5866107bf1

    • SHA256

      db5efedcf343d8356bfd6bdd41719f7c1f8ee994060c9aae44da1cdd672ec6df

    • SHA512

      9d3c5c9bfd1aefa85838f6fb60ff4d11f98773d072ac2c5cd2bd7b1590025c6defaa226bd93905d2f693c9437015c7f32066125398e4b9d03ad3a74e33dce334

    • SSDEEP

      1536:nQxqcQu0iQ0KsgFWq/fpZl9c4QFABNitT2xLoxqxSnQ:Q/030KtFpBZnc4IABNhxLVUnQ

    Score
    10/10
    discoveryupxpersistence

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks