Overview

overview

10

Static

static

5

JaffaCakes...51.exe

windows7-x64

10

JaffaCakes...51.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_60cd2a9d6629a6f7909278d59ef17f51

  • Size

    176KB

  • Sample

    250101-1hsppswjbt

  • MD5

    60cd2a9d6629a6f7909278d59ef17f51

  • SHA1

    036b6b3cc2e66bb6a2c92a973a16b9505ac4b128

  • SHA256

    9de3cf4e7e6130ac8e4af4a6dd1842b93d8727d7ee397a6f66a19a5d0cf9c536

  • SHA512

    3b28835e32ad54553a7535fbd417d3efc4ce1cab312fca9e79849a0c41c4bb36a9f5dde95cb62b1a6011af13e2d6574ff90cf29be3055a930aaf289657ea1dc2

  • SSDEEP

    3072:8T/55OCLuvYVjHe2PWudHriAXmJ4N/rkqMCSUxRrB9y2:8tKYVjHe2PHriAXlRkzS7

Score
10/10
ramnitbankerdiscoverypersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      JaffaCakes118_60cd2a9d6629a6f7909278d59ef17f51

    • Size

      176KB

    • MD5

      60cd2a9d6629a6f7909278d59ef17f51

    • SHA1

      036b6b3cc2e66bb6a2c92a973a16b9505ac4b128

    • SHA256

      9de3cf4e7e6130ac8e4af4a6dd1842b93d8727d7ee397a6f66a19a5d0cf9c536

    • SHA512

      3b28835e32ad54553a7535fbd417d3efc4ce1cab312fca9e79849a0c41c4bb36a9f5dde95cb62b1a6011af13e2d6574ff90cf29be3055a930aaf289657ea1dc2

    • SSDEEP

      3072:8T/55OCLuvYVjHe2PWudHriAXmJ4N/rkqMCSUxRrB9y2:8tKYVjHe2PHriAXlRkzS7

    Score
    10/10
    ramnitbankerdiscoverypersistencespywarestealertrojanupxworm

    • Modifies WinLogon for persistence

      persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Ramnit family

      ramnit

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks