Overview

overview

7

Static

static

3

dc0a5d7eca...18.exe

windows7-x64

7

dc0a5d7eca...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dc0a5d7ecafdb24461a3f5a85ddfeb27_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240912-hyh64axdrc

  • MD5

    dc0a5d7ecafdb24461a3f5a85ddfeb27

  • SHA1

    8a3b86fac1ce796264517d8add93f95aa9736b96

  • SHA256

    b880738828b794a5af57241033e3d8c563a6e42bae4ba6b801a5090e19e6b556

  • SHA512

    4bea4ac97dc02debc52e6671c9e1c6ca4aa3e8f97a7c618e67afb07a25162f9a3bbacd9a4967a2345cf26772eeffe5ec1b339f7b0d7c6e950498b7d781dad097

  • SSDEEP

    24576:nDEVYFPSdDbkTKcRWfbw3lUQLMmfi7B/lw70BWtVgMAHeLudnB:nDEVYFPsHk+cIT4lUqi7BWgBG3AHeydB

Score
7/10
discoveryupxvmprotect

Malware Config

Targets

    • Target

      dc0a5d7ecafdb24461a3f5a85ddfeb27_JaffaCakes118

    • Size

      1.2MB

    • MD5

      dc0a5d7ecafdb24461a3f5a85ddfeb27

    • SHA1

      8a3b86fac1ce796264517d8add93f95aa9736b96

    • SHA256

      b880738828b794a5af57241033e3d8c563a6e42bae4ba6b801a5090e19e6b556

    • SHA512

      4bea4ac97dc02debc52e6671c9e1c6ca4aa3e8f97a7c618e67afb07a25162f9a3bbacd9a4967a2345cf26772eeffe5ec1b339f7b0d7c6e950498b7d781dad097

    • SSDEEP

      24576:nDEVYFPSdDbkTKcRWfbw3lUQLMmfi7B/lw70BWtVgMAHeLudnB:nDEVYFPsHk+cIT4lUqi7BWgBG3AHeydB

    Score
    7/10
    discoveryupxvmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks