Overview

overview

10

Static

static

5

JaffaCakes...00.exe

windows7-x64

10

JaffaCakes...00.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_68869cc0475ce671c4fd584d5a761800

  • Size

    285KB

  • Sample

    250102-14q31a1kap

  • MD5

    68869cc0475ce671c4fd584d5a761800

  • SHA1

    5440e6da869f906a2a7bae68b4d39ecb35e6f7b2

  • SHA256

    8361913431105284496b526e76129935f4ec7539371de9f332a8bd315983c05f

  • SHA512

    93f5f9259820b651243609a2135c7d62f1e32f822a27592553b50d753405e317d29f70a5b8c8c860e436e3c0e32f6ca00b477db8017001f68429caef4801378c

  • SSDEEP

    3072:WStk3EHBRCYShDTOVoAUSu62DeIQnPATtwkb4ir:WuYEhRkDTpSdlPnPATeAXr

Score
10/10
ramnitbankerdiscoverypersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      JaffaCakes118_68869cc0475ce671c4fd584d5a761800

    • Size

      285KB

    • MD5

      68869cc0475ce671c4fd584d5a761800

    • SHA1

      5440e6da869f906a2a7bae68b4d39ecb35e6f7b2

    • SHA256

      8361913431105284496b526e76129935f4ec7539371de9f332a8bd315983c05f

    • SHA512

      93f5f9259820b651243609a2135c7d62f1e32f822a27592553b50d753405e317d29f70a5b8c8c860e436e3c0e32f6ca00b477db8017001f68429caef4801378c

    • SSDEEP

      3072:WStk3EHBRCYShDTOVoAUSu62DeIQnPATtwkb4ir:WuYEhRkDTpSdlPnPATeAXr

    Score
    10/10
    ramnitbankerdiscoverypersistencespywarestealertrojanupxworm

    • Modifies WinLogon for persistence

      persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Ramnit family

      ramnit

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks