Overview

overview

7

Static

static

3

64e76d2215...18.exe

windows7-x64

7

64e76d2215...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    64e76d2215a6b01cb2bebc0bafe5b9e6_JaffaCakes118

  • Size

    5.2MB

  • Sample

    240722-1mct2szcnc

  • MD5

    64e76d2215a6b01cb2bebc0bafe5b9e6

  • SHA1

    a5df8547629b854cbd3529bac40e3f40eb5f6820

  • SHA256

    d0902c6d183f4ab00c64dd9b787ec0d3719616aba79403f85e3b221f1f0c51c4

  • SHA512

    ab523f307c3c91f85950f550857b92642c5e18dc2f23eb786527a0e580659161bc99c08308eca3b27eeb3ced3ecaee66e74e8d01692fbf6af772c4b2fcd424af

  • SSDEEP

    49152:T/yJ4INy79445JsZkjfEqmYuGVwmec8PwfFgy/BqC9icj8YrxaJh05R5m9jd/Crg:Q

Score
7/10
persistencevmprotect

Malware Config

Targets

    • Target

      64e76d2215a6b01cb2bebc0bafe5b9e6_JaffaCakes118

    • Size

      5.2MB

    • MD5

      64e76d2215a6b01cb2bebc0bafe5b9e6

    • SHA1

      a5df8547629b854cbd3529bac40e3f40eb5f6820

    • SHA256

      d0902c6d183f4ab00c64dd9b787ec0d3719616aba79403f85e3b221f1f0c51c4

    • SHA512

      ab523f307c3c91f85950f550857b92642c5e18dc2f23eb786527a0e580659161bc99c08308eca3b27eeb3ced3ecaee66e74e8d01692fbf6af772c4b2fcd424af

    • SSDEEP

      49152:T/yJ4INy79445JsZkjfEqmYuGVwmec8PwfFgy/BqC9icj8YrxaJh05R5m9jd/Crg:Q

    Score
    7/10
    persistencevmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks