Overview

overview

7

Static

static

3

2dec5f3715...18.exe

windows7-x64

7

2dec5f3715...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    2dec5f3715372dc1411282237a1704ed_JaffaCakes118

  • Size

    449KB

  • Sample

    241009-kdg5eashrd

  • MD5

    2dec5f3715372dc1411282237a1704ed

  • SHA1

    22c3f5d7f4e134b1f66c1a9aa11e8b8314ebc4d8

  • SHA256

    745e9e6ae69bbb9db72bf2cfb6023f09118f4ff4f8b55d515f3bb7e6637736dd

  • SHA512

    da063bd37de02f54a6dc3dbdede30ed1d45763ea57b804e585c494ecc52b35af1d7e1b81c9d25ae91d4232d70c2054f9a884aa03b1243de92a01e890d606fd76

  • SSDEEP

    6144:Q/0uoa1Ta4CHLSm2lcoywo8+4zgvSIMsZQdVREmbs6YNxz1G0kyZuFE1IeD4b7IH:QJBtbD+4MaDmwYNxz1Wy8+RrJJ86y+sC

Score
7/10
discoverypersistenceupxvmprotect

Malware Config

Targets

    • Target

      2dec5f3715372dc1411282237a1704ed_JaffaCakes118

    • Size

      449KB

    • MD5

      2dec5f3715372dc1411282237a1704ed

    • SHA1

      22c3f5d7f4e134b1f66c1a9aa11e8b8314ebc4d8

    • SHA256

      745e9e6ae69bbb9db72bf2cfb6023f09118f4ff4f8b55d515f3bb7e6637736dd

    • SHA512

      da063bd37de02f54a6dc3dbdede30ed1d45763ea57b804e585c494ecc52b35af1d7e1b81c9d25ae91d4232d70c2054f9a884aa03b1243de92a01e890d606fd76

    • SSDEEP

      6144:Q/0uoa1Ta4CHLSm2lcoywo8+4zgvSIMsZQdVREmbs6YNxz1G0kyZuFE1IeD4b7IH:QJBtbD+4MaDmwYNxz1Wy8+RrJJ86y+sC

    Score
    7/10
    discoverypersistencevmprotectupx

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks