Overview

overview

8

Static

static

7

89f101e06d...18.exe

windows7-x64

8

89f101e06d...18.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    89f101e06d26b7690b486cdd3a7c21e8_JaffaCakes118

  • Size

    122KB

  • Sample

    240811-l1rg2ayfnb

  • MD5

    89f101e06d26b7690b486cdd3a7c21e8

  • SHA1

    326447d234a49498230856aef9814b54fe55baa1

  • SHA256

    9250ac11a64d8b0c49faf2d3e1e5c54d40dc2906b2a8469e88f1ffeaa77d5422

  • SHA512

    df28ee76c80c2ff62ac68356176b86be8fb1f1332c9bb428268a447d9b07e5ea0506b9b8f3f744de5e0f88a83cc25832dca8d1db35baf2d03f00a4b02c877f69

  • SSDEEP

    3072:gmD/Kn45L572ZWJu93zGUoSF3g6X8J4jlM6ZDqDZfB5FrGjp:jg+iZ7F370kqz6jp

Score
8/10
defense_evasiondiscoverypersistencevmprotect

Malware Config

Targets

    • Target

      89f101e06d26b7690b486cdd3a7c21e8_JaffaCakes118

    • Size

      122KB

    • MD5

      89f101e06d26b7690b486cdd3a7c21e8

    • SHA1

      326447d234a49498230856aef9814b54fe55baa1

    • SHA256

      9250ac11a64d8b0c49faf2d3e1e5c54d40dc2906b2a8469e88f1ffeaa77d5422

    • SHA512

      df28ee76c80c2ff62ac68356176b86be8fb1f1332c9bb428268a447d9b07e5ea0506b9b8f3f744de5e0f88a83cc25832dca8d1db35baf2d03f00a4b02c877f69

    • SSDEEP

      3072:gmD/Kn45L572ZWJu93zGUoSF3g6X8J4jlM6ZDqDZfB5FrGjp:jg+iZ7F370kqz6jp

    Score
    8/10
    defense_evasiondiscoverypersistencevmprotect

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

      persistence

    • Deletes itself

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks