Overview

overview

8

Static

static

3

cdd7642ac2...18.exe

windows7-x64

8

cdd7642ac2...18.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    cdd7642ac28a6aeab2880641aac03b24_JaffaCakes118

  • Size

    85KB

  • Sample

    240901-aaq8sstaqf

  • MD5

    cdd7642ac28a6aeab2880641aac03b24

  • SHA1

    ac91ec718a40bd2540c8adebc8d3a95c253a12f3

  • SHA256

    4dedb9e2fe4433650e59d7a06e6f2375870ddb69e52addec8ccfb05bc69febd8

  • SHA512

    c5ceae8cd78192d3538ccb53948889e0e8f07fa7588547ad0d9ba232eba58ae75f3f0c3739c17e19b7b4d920a83069f3b0655e8e5c5d635036bc7893e5dce192

  • SSDEEP

    1536:79/KLDvm+2ol1kFhh0z/VjCmPLXyGVRNijPNDZ6gg+evwdz+dE:R/Kvv32omno/VjfTfVinlg/w5+m

Score
8/10
discoverypersistencevmprotect

Malware Config

Targets

    • Target

      cdd7642ac28a6aeab2880641aac03b24_JaffaCakes118

    • Size

      85KB

    • MD5

      cdd7642ac28a6aeab2880641aac03b24

    • SHA1

      ac91ec718a40bd2540c8adebc8d3a95c253a12f3

    • SHA256

      4dedb9e2fe4433650e59d7a06e6f2375870ddb69e52addec8ccfb05bc69febd8

    • SHA512

      c5ceae8cd78192d3538ccb53948889e0e8f07fa7588547ad0d9ba232eba58ae75f3f0c3739c17e19b7b4d920a83069f3b0655e8e5c5d635036bc7893e5dce192

    • SSDEEP

      1536:79/KLDvm+2ol1kFhh0z/VjCmPLXyGVRNijPNDZ6gg+evwdz+dE:R/Kvv32omno/VjfTfVinlg/w5+m

    Score
    8/10
    discoverypersistencevmprotect

    • Server Software Component: Terminal Services DLL

      persistence

    • Deletes itself

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks