7845baea0ad22217e025fbe279cfba5ec9457407167b5106aaf6c46cab8dd5b1 | Triage

Sharing

General

Target

27553ffd7483441113a8846c1d412cfb_JaffaCakes118
Size

830KB
Sample

240706-eh3zsavelk
MD5

27553ffd7483441113a8846c1d412cfb
SHA1

80217e6c2519e79f159815afca3abc45157de162
SHA256

7845baea0ad22217e025fbe279cfba5ec9457407167b5106aaf6c46cab8dd5b1
SHA512

595987f3ea505eab071f0ab5515a3fe7d728efaa58b1992b8fc60c46de3d90327702bc52cf7329219efea2492d60b896d17c7e2a331684393d5bf1f5bba52528
SSDEEP

24576:ZxgrMRWjiOPEJYLUfZe/6z1QvbxNCjdmL3ctj:ZxqUAiULUf8/6z1EYjdmIt

Score

10^/10

evasion persistence trojan vmprotect

Malware Config

Targets

- Target
  
  27553ffd7483441113a8846c1d412cfb_JaffaCakes118
- Size
  
  830KB
- MD5
  
  27553ffd7483441113a8846c1d412cfb
- SHA1
  
  80217e6c2519e79f159815afca3abc45157de162
- SHA256
  
  7845baea0ad22217e025fbe279cfba5ec9457407167b5106aaf6c46cab8dd5b1
- SHA512
  
  595987f3ea505eab071f0ab5515a3fe7d728efaa58b1992b8fc60c46de3d90327702bc52cf7329219efea2492d60b896d17c7e2a331684393d5bf1f5bba52528
- SSDEEP
  
  24576:ZxgrMRWjiOPEJYLUfZe/6z1QvbxNCjdmL3ctj:ZxqUAiULUf8/6z1EYjdmIt
Score

10^/10

evasion persistence trojan vmprotect
- UAC bypass
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojanvmprotect

behavioral2

evasionpersistencetrojanvmprotect