General

  • Target

    12dc5e109271df7ab97e7422408f12d8_JaffaCakes118

  • Size

    744KB

  • Sample

    240626-weksgayarl

  • MD5

    12dc5e109271df7ab97e7422408f12d8

  • SHA1

    fcb61bf1485504bcab2b986c1e40974a9d3f6dbf

  • SHA256

    e58041fd1586a75e7616f428694364c2c9df6268d112a93b7fc94f3f37311a7f

  • SHA512

    1f668c4d88c745832203e2dfed1c1bc47a8e6755ff48c24655df3618e3cc7f1696a390f178f2c5c0d883338dc226a02f132c24ffd950af11c5e2716aa4779af8

  • SSDEEP

    12288:tLLxr5cBXHAdY+rX7DnY5mBAVhHflm0GRqptFNTR1ICJn96Uqu4UdSea4ziizWV2:hLx6wz7rY50AIRqNH1ICtGu4UzGfw

Score
7/10

Malware Config

Targets

    • Target

      12dc5e109271df7ab97e7422408f12d8_JaffaCakes118

    • Size

      744KB

    • MD5

      12dc5e109271df7ab97e7422408f12d8

    • SHA1

      fcb61bf1485504bcab2b986c1e40974a9d3f6dbf

    • SHA256

      e58041fd1586a75e7616f428694364c2c9df6268d112a93b7fc94f3f37311a7f

    • SHA512

      1f668c4d88c745832203e2dfed1c1bc47a8e6755ff48c24655df3618e3cc7f1696a390f178f2c5c0d883338dc226a02f132c24ffd950af11c5e2716aa4779af8

    • SSDEEP

      12288:tLLxr5cBXHAdY+rX7DnY5mBAVhHflm0GRqptFNTR1ICJn96Uqu4UdSea4ziizWV2:hLx6wz7rY50AIRqNH1ICtGu4UzGfw

    Score
    7/10
    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks