Overview

overview

8

Static

static

3

6da39313a0...18.exe

windows7-x64

8

6da39313a0...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6da39313a03c88b3f1af1654faffab64_JaffaCakes118

  • Size

    85KB

  • Sample

    241023-hyqk6syhmr

  • MD5

    6da39313a03c88b3f1af1654faffab64

  • SHA1

    6082763139828f692ccc7ea06d46dbbe7d6794ee

  • SHA256

    b44ae97a44a8bf3a060e91929a76cb7f90964c767430a112aec866583fe547f1

  • SHA512

    b7e3b38f5fc148b0f1b0ceb4713cb9639337444753945b7a0b5288502654ae8ae13873b0b6833e54bf643b40bd847a92608240bbccda342b435ffe9cd8e69fd4

  • SSDEEP

    1536:5HcCnNTr0e+DelaCFcxKen/wFnToIfHTR7r5JkNT89mFp0zA+V/R8O:5HcQ0e+Dcen/wtTBfHTR7r5JkNT89mPy

Score
8/10
defense_evasiondiscoverypersistencevmprotect

Malware Config

Targets

    • Target

      6da39313a03c88b3f1af1654faffab64_JaffaCakes118

    • Size

      85KB

    • MD5

      6da39313a03c88b3f1af1654faffab64

    • SHA1

      6082763139828f692ccc7ea06d46dbbe7d6794ee

    • SHA256

      b44ae97a44a8bf3a060e91929a76cb7f90964c767430a112aec866583fe547f1

    • SHA512

      b7e3b38f5fc148b0f1b0ceb4713cb9639337444753945b7a0b5288502654ae8ae13873b0b6833e54bf643b40bd847a92608240bbccda342b435ffe9cd8e69fd4

    • SSDEEP

      1536:5HcCnNTr0e+DelaCFcxKen/wFnToIfHTR7r5JkNT89mFp0zA+V/R8O:5HcQ0e+Dcen/wtTBfHTR7r5JkNT89mPy

    Score
    8/10
    defense_evasiondiscoverypersistencevmprotect

    • Server Software Component: Terminal Services DLL

      persistence

    • Deletes itself

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks