Overview

overview

7

Static

static

3

3cf47026ea...18.exe

windows7-x64

7

3cf47026ea...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    3cf47026ea81ca698d8ab4962e64e00a_JaffaCakes118

  • Size

    2.6MB

  • Sample

    241013-bdevlsvfpj

  • MD5

    3cf47026ea81ca698d8ab4962e64e00a

  • SHA1

    d8f9cbf1685a07aa0e22f840a2b0987d90fb1b36

  • SHA256

    19d717afd7212dc8eb01046eefc646b3927f71cb333b84c9f192922390241bd3

  • SHA512

    b0d4c40623ab9fdbeced6b0bc879e569544e6e2077e242763052767e7a08900b531f04633ca60dbdea2bb83383b7ce1c7eb962955b864dfd732fc13a2f351994

  • SSDEEP

    49152:kc//////OQqyUaufy+E3EuDtRq6is9VSLbbIiJMc1wxDurHWVc6gb1sK8ywFZ:kc//////OXMF3EuOM/SLbbIiOcMD+y2U

Score
7/10
discoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      3cf47026ea81ca698d8ab4962e64e00a_JaffaCakes118

    • Size

      2.6MB

    • MD5

      3cf47026ea81ca698d8ab4962e64e00a

    • SHA1

      d8f9cbf1685a07aa0e22f840a2b0987d90fb1b36

    • SHA256

      19d717afd7212dc8eb01046eefc646b3927f71cb333b84c9f192922390241bd3

    • SHA512

      b0d4c40623ab9fdbeced6b0bc879e569544e6e2077e242763052767e7a08900b531f04633ca60dbdea2bb83383b7ce1c7eb962955b864dfd732fc13a2f351994

    • SSDEEP

      49152:kc//////OQqyUaufy+E3EuDtRq6is9VSLbbIiJMc1wxDurHWVc6gb1sK8ywFZ:kc//////OXMF3EuOM/SLbbIiOcMD+y2U

    Score
    7/10
    discoveryevasionpersistencetrojanupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks whether UAC is enabled

      evasiontrojan

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks