05bb3182372c5fd36528632bd6d6b70167684bca94f0edfd30c7d0e8982a12a5 | Triage

Submit
Reports

Overview

overview

7

Static

static

5

0d5a11af92...18.exe

windows7-x64

7

0d5a11af92...18.exe

windows10-2004-x64

7

Sharing

General

Target

0d5a11af9212476171afd5c8457bdaa6_JaffaCakes118
Size

51KB
Sample

241003-b6klkayanm
MD5

0d5a11af9212476171afd5c8457bdaa6
SHA1

a9a00614b0e030d7c4bc7a0aa70f91f821b41ef6
SHA256

05bb3182372c5fd36528632bd6d6b70167684bca94f0edfd30c7d0e8982a12a5
SHA512

40426e33e335159c1b44782b53889257a85f3075da499b4189a5449a909a164f64c55634a57cda144f48f7588c5eda20777bd21f83964811d430d4a00108204e
SSDEEP

768:9Fx7SMdYumZJ16zj5ncgoE2B5mSdIw/j3FFPrlycnm8f0r7HemcMb:LxjdAi2RE2B9dIwrDrlycm7rTeCb

Score

7^/10

defense_evasion discovery upx vmprotect

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

0d5a11af9212476171afd5c8457bdaa6_JaffaCakes118.exe

Resource

win7-20240708-en

defense_evasion discovery upx vmprotect

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

0d5a11af9212476171afd5c8457bdaa6_JaffaCakes118.exe

Resource

win10v2004-20240802-en

defense_evasion discovery upx vmprotect

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  0d5a11af9212476171afd5c8457bdaa6_JaffaCakes118
- Size
  
  51KB
- MD5
  
  0d5a11af9212476171afd5c8457bdaa6
- SHA1
  
  a9a00614b0e030d7c4bc7a0aa70f91f821b41ef6
- SHA256
  
  05bb3182372c5fd36528632bd6d6b70167684bca94f0edfd30c7d0e8982a12a5
- SHA512
  
  40426e33e335159c1b44782b53889257a85f3075da499b4189a5449a909a164f64c55634a57cda144f48f7588c5eda20777bd21f83964811d430d4a00108204e
- SSDEEP
  
  768:9Fx7SMdYumZJ16zj5ncgoE2B5mSdIw/j3FFPrlycnm8f0r7HemcMb:LxjdAi2RE2B9dIwrDrlycm7rTeCb
Score

7^/10

defense_evasion discovery upx vmprotect
- Deletes itself
- Loads dropped DLL
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

File Deletion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryupxvmprotect

behavioral2

defense_evasiondiscoveryupxvmprotect

© 2018-2024

Terms | Privacy