Overview

overview

10

Static

static

3

1702ec3e12...18.exe

windows7-x64

10

1702ec3e12...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1702ec3e1294c664987fee120474a0a2_JaffaCakes118

  • Size

    216KB

  • Sample

    240627-wwlfbstcqa

  • MD5

    1702ec3e1294c664987fee120474a0a2

  • SHA1

    f62f43fc48413168b47b122d8fbe793009d698a0

  • SHA256

    3c0f144939f2009cb2f8c835c9b1493b43d7bed1c78f6a76d2fab732c546dfdf

  • SHA512

    bf5a1e15e8339557cfbc8c7b6b7d9a34bc046b318dd06144571cde02e4deafefe58f88f0876b00fb2f3f1865579f5962a54547c1fe1dbfa39aef1210cc8dd402

  • SSDEEP

    3072:blFQnZn9H/W07Uhh3jxswLE97oAy3kZ5zR65RBviWaIixrDMmAkS2IuAQ:4fOEUhTLU7oA7vITBSVRDMmLe

Score
10/10
ramnitbankerpersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      1702ec3e1294c664987fee120474a0a2_JaffaCakes118

    • Size

      216KB

    • MD5

      1702ec3e1294c664987fee120474a0a2

    • SHA1

      f62f43fc48413168b47b122d8fbe793009d698a0

    • SHA256

      3c0f144939f2009cb2f8c835c9b1493b43d7bed1c78f6a76d2fab732c546dfdf

    • SHA512

      bf5a1e15e8339557cfbc8c7b6b7d9a34bc046b318dd06144571cde02e4deafefe58f88f0876b00fb2f3f1865579f5962a54547c1fe1dbfa39aef1210cc8dd402

    • SSDEEP

      3072:blFQnZn9H/W07Uhh3jxswLE97oAy3kZ5zR65RBviWaIixrDMmAkS2IuAQ:4fOEUhTLU7oA7vITBSVRDMmLe

    Score
    10/10
    ramnitbankerpersistencespywarestealertrojanupxworm

    • Modifies WinLogon for persistence

      persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks