General

  • Target

    JaffaCakes118_438bc930efd909c8bc2313fd00f99957

  • Size

    123KB

  • Sample

    250127-zlpxjsvrfn

  • MD5

    438bc930efd909c8bc2313fd00f99957

  • SHA1

    704794d8983d4f94ceb1395170bf1a70126a18a3

  • SHA256

    28da5b8afc8335371104a758b99e3c186d4b0e5f392e0a9c46f79fdf8cd42d71

  • SHA512

    55f42889203bbf0e63d2e6bf3075ff7c77f04d433aa2bfcfaef89ce3d5535a90dea1be218c0a68456b2d58ae4eb5a6f60820433377a4e1b0f52f336e71aeda3c

  • SSDEEP

    3072:OeSQ41MZrrOwzrq5Ss9eYfphfFQkUcot3EpeBWLLAw+X1hY:OVYrJrOSsRwcphg1hY

Score
8/10

Malware Config

Targets

    • Target

      JaffaCakes118_438bc930efd909c8bc2313fd00f99957

    • Size

      123KB

    • MD5

      438bc930efd909c8bc2313fd00f99957

    • SHA1

      704794d8983d4f94ceb1395170bf1a70126a18a3

    • SHA256

      28da5b8afc8335371104a758b99e3c186d4b0e5f392e0a9c46f79fdf8cd42d71

    • SHA512

      55f42889203bbf0e63d2e6bf3075ff7c77f04d433aa2bfcfaef89ce3d5535a90dea1be218c0a68456b2d58ae4eb5a6f60820433377a4e1b0f52f336e71aeda3c

    • SSDEEP

      3072:OeSQ41MZrrOwzrq5Ss9eYfphfFQkUcot3EpeBWLLAw+X1hY:OVYrJrOSsRwcphg1hY

    Score
    8/10
    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks