Overview

overview

8

Static

static

3

28ea4688b0...18.exe

windows7-x64

8

28ea4688b0...18.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    28ea4688b01ba8a30c54eaad99a699f2_JaffaCakes118

  • Size

    2.5MB

  • Sample

    240706-vgl8mswbnk

  • MD5

    28ea4688b01ba8a30c54eaad99a699f2

  • SHA1

    b49a760186fa3715b307162e18dca70b26bcc02d

  • SHA256

    a8117c7ef52af0ed330182fb8f42d4edf1321a9f73e43630c7d38bbca74cc6f2

  • SHA512

    12c172ca2d1c4fc375c96a94a473e86e7d8efc3920b61f1f33fdf74cefeec5516cbb1b620c1cb5bf39a91e1e33ca9e1bef85b9ecc79fe985b222f2951ef9aacd

  • SSDEEP

    49152:PnCVwNDh9wCG0f3/Ok7TryD+ZgPGCC+SKEvCup:oQDjhfPOk6enKup

Score
8/10
persistencethemida

Malware Config

Targets

    • Target

      28ea4688b01ba8a30c54eaad99a699f2_JaffaCakes118

    • Size

      2.5MB

    • MD5

      28ea4688b01ba8a30c54eaad99a699f2

    • SHA1

      b49a760186fa3715b307162e18dca70b26bcc02d

    • SHA256

      a8117c7ef52af0ed330182fb8f42d4edf1321a9f73e43630c7d38bbca74cc6f2

    • SHA512

      12c172ca2d1c4fc375c96a94a473e86e7d8efc3920b61f1f33fdf74cefeec5516cbb1b620c1cb5bf39a91e1e33ca9e1bef85b9ecc79fe985b222f2951ef9aacd

    • SSDEEP

      49152:PnCVwNDh9wCG0f3/Ok7TryD+ZgPGCC+SKEvCup:oQDjhfPOk6enKup

    Score
    8/10
    persistencethemida

    • Adds policy Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks