Overview

overview

7

Static

static

3

28ecec70ab...18.exe

windows7-x64

7

28ecec70ab...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    28ecec70ab6c15ec6cd50b9f461711e1_JaffaCakes118

  • Size

    641KB

  • Sample

    241009-ckdfsswhqe

  • MD5

    28ecec70ab6c15ec6cd50b9f461711e1

  • SHA1

    8fb1fd2922144c9ba3afa06a2de4b02e2f415f48

  • SHA256

    8c66654b8d50efed2582d27a73fa959ca1b9675c2a93778514be1b3b2a963840

  • SHA512

    528b37e15cf67d071d931973cb83aaf7863855fddf5494730901f103aa15d9c8a6e8a4d33d9178b34b1df35928682d01ab246c8f9bbcff89bcb79af70544636d

  • SSDEEP

    12288:7q+ofLruQnLrEZN7PpOr++Y9saNzcQGcq7B4TgEcLTv:knL/ZMsaNzcQuOEE

Score
7/10
discoverypersistenceupx

Malware Config

Targets

    • Target

      28ecec70ab6c15ec6cd50b9f461711e1_JaffaCakes118

    • Size

      641KB

    • MD5

      28ecec70ab6c15ec6cd50b9f461711e1

    • SHA1

      8fb1fd2922144c9ba3afa06a2de4b02e2f415f48

    • SHA256

      8c66654b8d50efed2582d27a73fa959ca1b9675c2a93778514be1b3b2a963840

    • SHA512

      528b37e15cf67d071d931973cb83aaf7863855fddf5494730901f103aa15d9c8a6e8a4d33d9178b34b1df35928682d01ab246c8f9bbcff89bcb79af70544636d

    • SSDEEP

      12288:7q+ofLruQnLrEZN7PpOr++Y9saNzcQGcq7B4TgEcLTv:knL/ZMsaNzcQuOEE

    Score
    7/10
    discoveryupxpersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks