Overview

overview

7

Static

static

5

6f00000dd2...18.exe

windows7-x64

7

6f00000dd2...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6f00000dd29bbea966ff98b248776a32_JaffaCakes118

  • Size

    205KB

  • Sample

    241023-pz318a1are

  • MD5

    6f00000dd29bbea966ff98b248776a32

  • SHA1

    3a29f6dafcc0dbb32dff4eab7495388aca7b98e2

  • SHA256

    09acbb7883d2fd738919731bc9d5803dc61727f7a49b534769f095bb0ce9b5b4

  • SHA512

    6c6167115319807c47ee0289cce2b0f28dcdcfb38d2789bca871490aef069f53506e3fe7769951c5c4e9d50694a8c8fe7bf4a11cb5ee6300dca528fbb73d172c

  • SSDEEP

    3072:9iAiJJy0b4JlkkxrwtULqVeSazw7EW19wBKj:oAzrwOLwazw7H19wBKj

Score
7/10
defense_evasiondiscoveryupxvmprotect

Malware Config

Targets

    • Target

      6f00000dd29bbea966ff98b248776a32_JaffaCakes118

    • Size

      205KB

    • MD5

      6f00000dd29bbea966ff98b248776a32

    • SHA1

      3a29f6dafcc0dbb32dff4eab7495388aca7b98e2

    • SHA256

      09acbb7883d2fd738919731bc9d5803dc61727f7a49b534769f095bb0ce9b5b4

    • SHA512

      6c6167115319807c47ee0289cce2b0f28dcdcfb38d2789bca871490aef069f53506e3fe7769951c5c4e9d50694a8c8fe7bf4a11cb5ee6300dca528fbb73d172c

    • SSDEEP

      3072:9iAiJJy0b4JlkkxrwtULqVeSazw7EW19wBKj:oAzrwOLwazw7H19wBKj

    Score
    7/10
    defense_evasiondiscoveryupxvmprotect

    • Deletes itself

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks