1c085a90278ee31c62e7fcfb37996c7906ab4365aaf465491ddf33ea79d3604c | Triage

Submit
Reports

Overview

overview

8

Static

static

7

e0eb7cbf85...18.exe

windows7-x64

8

e0eb7cbf85...18.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

Target

e0eb7cbf856067346ace44008a2e68c0_JaffaCakes118
Size

51KB
Sample

240914-ymactasflr
MD5

e0eb7cbf856067346ace44008a2e68c0
SHA1

0b3b826334426b73163d0964b80b885db628dc1d
SHA256

1c085a90278ee31c62e7fcfb37996c7906ab4365aaf465491ddf33ea79d3604c
SHA512

fb12615dd58bf6b28ff05a6604d9ed31ca0d5c3ad17456e76d9a9b7d36780cb25e62c04b06fab44b6b5b0ed29032b6055735ac0e63d47c9e42a7bbad5a552ada
SSDEEP

768:ekYTL0bL6eLz7vydjFFw0rqEIn5CHV7M5EHdMtSLskgrzjETxr3AKxBm:5qA6ynvyfFwxBn5czHmIskWz5IBm

Score

8^/10

defense_evasion discovery persistence upx vmprotect

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

e0eb7cbf856067346ace44008a2e68c0_JaffaCakes118.exe

Resource

win7-20240903-en

defense_evasion discovery persistence upx vmprotect

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

e0eb7cbf856067346ace44008a2e68c0_JaffaCakes118.exe

Resource

win10v2004-20240802-en

defense_evasion discovery persistence upx vmprotect

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  e0eb7cbf856067346ace44008a2e68c0_JaffaCakes118
- Size
  
  51KB
- MD5
  
  e0eb7cbf856067346ace44008a2e68c0
- SHA1
  
  0b3b826334426b73163d0964b80b885db628dc1d
- SHA256
  
  1c085a90278ee31c62e7fcfb37996c7906ab4365aaf465491ddf33ea79d3604c
- SHA512
  
  fb12615dd58bf6b28ff05a6604d9ed31ca0d5c3ad17456e76d9a9b7d36780cb25e62c04b06fab44b6b5b0ed29032b6055735ac0e63d47c9e42a7bbad5a552ada
- SSDEEP
  
  768:ekYTL0bL6eLz7vydjFFw0rqEIn5CHV7M5EHdMtSLskgrzjETxr3AKxBm:5qA6ynvyfFwxBn5czHmIskWz5IBm
Score

8^/10

defense_evasion discovery persistence upx vmprotect
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
  persistence
- Deletes itself
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

Terminal Services DLL

Privilege Escalation

Defense Evasion

Indicator Removal

File Deletion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoverypersistenceupxvmprotect

behavioral2

defense_evasiondiscoverypersistenceupxvmprotect

© 2018-2025

Terms | Privacy