Overview

overview

7

Static

static

3

41070e3c33...18.exe

windows7-x64

7

41070e3c33...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    41070e3c338e5687ac40447b09c32f20_JaffaCakes118

  • Size

    2.3MB

  • Sample

    241013-vhfr9a1hpm

  • MD5

    41070e3c338e5687ac40447b09c32f20

  • SHA1

    d6467e39c32a16162f11d06b958228cd3095f841

  • SHA256

    ef0248c03f9b59ee67bbe4eaf2ee60f2ec2a0f02969b86eb518cf3309384c8f2

  • SHA512

    67a6f041fc008918e720525a5f8d9e579f6936f110a510ab7a75ce4dfe17796d58ad285729c984a78a2dc15f025107e6934d9f1ab5c52ff92c987db772c45343

  • SSDEEP

    49152:OWI3IRwso6b/6jlc5ueZXcrnV74i1RPlIZe4Dl1OdHGT:M3Oo6byjlvelch7rRP6cwtT

Score
7/10
discoveryevasionpersistenceupx

Malware Config

Targets

    • Target

      41070e3c338e5687ac40447b09c32f20_JaffaCakes118

    • Size

      2.3MB

    • MD5

      41070e3c338e5687ac40447b09c32f20

    • SHA1

      d6467e39c32a16162f11d06b958228cd3095f841

    • SHA256

      ef0248c03f9b59ee67bbe4eaf2ee60f2ec2a0f02969b86eb518cf3309384c8f2

    • SHA512

      67a6f041fc008918e720525a5f8d9e579f6936f110a510ab7a75ce4dfe17796d58ad285729c984a78a2dc15f025107e6934d9f1ab5c52ff92c987db772c45343

    • SSDEEP

      49152:OWI3IRwso6b/6jlc5ueZXcrnV74i1RPlIZe4Dl1OdHGT:M3Oo6byjlvelch7rRP6cwtT

    Score
    7/10
    discoveryevasionpersistenceupx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks