Overview

overview

8

Static

static

3

2f0c1e1428...18.exe

windows7-x64

8

2f0c1e1428...18.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2f0c1e1428ffe1e6a49701c9e868b4ad_JaffaCakes118

  • Size

    85KB

  • Sample

    240709-fjc1esxbjm

  • MD5

    2f0c1e1428ffe1e6a49701c9e868b4ad

  • SHA1

    6e58844efde10feae2ff24379526791ee3f91d83

  • SHA256

    f874732e16e1247bdcea30d08f322e0bf32a926d8007ca4a66228e26e0b8f634

  • SHA512

    a495fe5187e5b3c9d5bf05734789f179963e26a3d14eef1e0e847d3381296a47fd428a979a2524d7a2bac28a6ef64047b1db94a2498b9c01e3bbb6aa7a74b2bc

  • SSDEEP

    1536:JZzpf8qLOuz4wi0ipQ8f7VffnFnToIf5TR/r5ZANbWmuw8G8m:vzpUqbpUxVffntTBf5TR/r5ZANbWqr8m

Score
8/10
persistencevmprotect

Malware Config

Targets

    • Target

      2f0c1e1428ffe1e6a49701c9e868b4ad_JaffaCakes118

    • Size

      85KB

    • MD5

      2f0c1e1428ffe1e6a49701c9e868b4ad

    • SHA1

      6e58844efde10feae2ff24379526791ee3f91d83

    • SHA256

      f874732e16e1247bdcea30d08f322e0bf32a926d8007ca4a66228e26e0b8f634

    • SHA512

      a495fe5187e5b3c9d5bf05734789f179963e26a3d14eef1e0e847d3381296a47fd428a979a2524d7a2bac28a6ef64047b1db94a2498b9c01e3bbb6aa7a74b2bc

    • SSDEEP

      1536:JZzpf8qLOuz4wi0ipQ8f7VffnFnToIf5TR/r5ZANbWmuw8G8m:vzpUqbpUxVffntTBf5TR/r5ZANbWqr8m

    Score
    8/10
    persistencevmprotect

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

      persistence

    • Deletes itself

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks