Overview

overview

10

Static

static

10

JackIsWSigma.exe

windows7-x64

7

JackIsWSigma.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JackIsWSigma.exe

  • Size

    82.0MB

  • Sample

    241006-y9pq1sycpb

  • MD5

    b65644f7b4bf70430cb61b24c0a820a1

  • SHA1

    859d321cbdbb9e007f800c47903b49134124da12

  • SHA256

    7b8db21e5412636fb0dceea0696ceb8242dc4e264200cbbd959f554fe7ce27c9

  • SHA512

    3c60e8fadaffd0e0a5ecfa744a959d5dcd39525e559e55d84563108f42d78c665982f3c7f53a524f2261b5e694c9df35d51869399c988d6add595fd9a70a96ec

  • SSDEEP

    1572864:OtScl7WLh8Sk8IpG7V+VPhqYdfkE7nli/iYgj+h58sMwoKDWawJk:OQcpAh8SkB05awcf5wh5sYJ

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      JackIsWSigma.exe

    • Size

      82.0MB

    • MD5

      b65644f7b4bf70430cb61b24c0a820a1

    • SHA1

      859d321cbdbb9e007f800c47903b49134124da12

    • SHA256

      7b8db21e5412636fb0dceea0696ceb8242dc4e264200cbbd959f554fe7ce27c9

    • SHA512

      3c60e8fadaffd0e0a5ecfa744a959d5dcd39525e559e55d84563108f42d78c665982f3c7f53a524f2261b5e694c9df35d51869399c988d6add595fd9a70a96ec

    • SSDEEP

      1572864:OtScl7WLh8Sk8IpG7V+VPhqYdfkE7nli/iYgj+h58sMwoKDWawJk:OQcpAh8SkB05awcf5wh5sYJ

    Score
    9/10
    upxevasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks