Overview

overview

7

Static

static

5

036072c307...18.exe

windows7-x64

7

036072c307...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    036072c3073c380bdde8d11b47c6e3fa_JaffaCakes118

  • Size

    42KB

  • Sample

    240930-1pasga1ana

  • MD5

    036072c3073c380bdde8d11b47c6e3fa

  • SHA1

    9c1807d85ed8b0b3104e331f7e6e9b64129b9d30

  • SHA256

    f91874f206cc1634f1b180e7142297d8b7f6eb0c10763dc20fa2444067918880

  • SHA512

    3076e67f2b9b373f75bda17335b0e4d331f9fd16ae49abaa0503956047ff80ee7795809acb963afa7af2ea16a5280e9dd58a54989428b2b67a6f5fef56776412

  • SSDEEP

    768:HBCmFxJuAhfNUK0cLlF+jqPLkqZWaKZ9e7z913lqYrZUC9N660oi:hL5f30aF++LZWa0Uz73UsUm0

Score
7/10
discoverypersistenceupxvmprotect

Malware Config

Targets

    • Target

      036072c3073c380bdde8d11b47c6e3fa_JaffaCakes118

    • Size

      42KB

    • MD5

      036072c3073c380bdde8d11b47c6e3fa

    • SHA1

      9c1807d85ed8b0b3104e331f7e6e9b64129b9d30

    • SHA256

      f91874f206cc1634f1b180e7142297d8b7f6eb0c10763dc20fa2444067918880

    • SHA512

      3076e67f2b9b373f75bda17335b0e4d331f9fd16ae49abaa0503956047ff80ee7795809acb963afa7af2ea16a5280e9dd58a54989428b2b67a6f5fef56776412

    • SSDEEP

      768:HBCmFxJuAhfNUK0cLlF+jqPLkqZWaKZ9e7z913lqYrZUC9N660oi:hL5f30aF++LZWa0Uz73UsUm0

    Score
    7/10
    discoverypersistenceupxvmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks