Overview

overview

8

Static

static

5

8275fc0d93...18.exe

windows7-x64

8

8275fc0d93...18.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8275fc0d9355faab170909637574f0a0_JaffaCakes118

  • Size

    123KB

  • Sample

    241031-kc31gsvfjn

  • MD5

    8275fc0d9355faab170909637574f0a0

  • SHA1

    d535767af5f718bc0c863bb1256cb2060450191e

  • SHA256

    79ef292c64f683e4a1f0f0617e9c4bae02efe89ad555292b35bc190efe8fc40b

  • SHA512

    2f586235d3a3872269f22d2ade8669262bc36bdd01a6d68ffeee37deb90be48e863160551e10e29be7ad756bd694f6017e10c719c8dedc57115fceedca926cd3

  • SSDEEP

    3072:OeSQ41MZrrOwzrq5Ss9eYfphfFQkUcot3EpeBWLLMe:OVYrJrOSsRwcpqe

Score
8/10
discoveryupx

Malware Config

Targets

    • Target

      8275fc0d9355faab170909637574f0a0_JaffaCakes118

    • Size

      123KB

    • MD5

      8275fc0d9355faab170909637574f0a0

    • SHA1

      d535767af5f718bc0c863bb1256cb2060450191e

    • SHA256

      79ef292c64f683e4a1f0f0617e9c4bae02efe89ad555292b35bc190efe8fc40b

    • SHA512

      2f586235d3a3872269f22d2ade8669262bc36bdd01a6d68ffeee37deb90be48e863160551e10e29be7ad756bd694f6017e10c719c8dedc57115fceedca926cd3

    • SSDEEP

      3072:OeSQ41MZrrOwzrq5Ss9eYfphfFQkUcot3EpeBWLLMe:OVYrJrOSsRwcpqe

    Score
    8/10
    discoveryupx

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks