Overview

overview

10

Static

static

3

6f39bef2b9...18.exe

windows7-x64

10

6f39bef2b9...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6f39bef2b991c3a0af1b5f6627d86a35_JaffaCakes118

  • Size

    1.2MB

  • Sample

    241023-q13yaaveqn

  • MD5

    6f39bef2b991c3a0af1b5f6627d86a35

  • SHA1

    2fdacae9eece2a9ce3490c3a387d6c490335a2d6

  • SHA256

    e2d1b0d24ef3372c4e89cab1cd52a0cbd862a76d9dcec3b3d8e9173da4791685

  • SHA512

    6cface4c65f11246f74afa3d2cb9592950a42946e959219c2d49ab7dfb29cc727b7f5b0e20dc9dfc523bbf0136d21517a7b99149ea6bdae0bbd3618f9e0b0a78

  • SSDEEP

    24576:IMc1bS0R6crXjYp36O1aNjoWBFJDq9SpCxfzs2o2SV/deDrgO:IMcxS0RTrzYp3/oNEWxq8pCRzro2SV/u

Score
10/10
renamerdiscoveryworm

Malware Config

Targets

    • Target

      6f39bef2b991c3a0af1b5f6627d86a35_JaffaCakes118

    • Size

      1.2MB

    • MD5

      6f39bef2b991c3a0af1b5f6627d86a35

    • SHA1

      2fdacae9eece2a9ce3490c3a387d6c490335a2d6

    • SHA256

      e2d1b0d24ef3372c4e89cab1cd52a0cbd862a76d9dcec3b3d8e9173da4791685

    • SHA512

      6cface4c65f11246f74afa3d2cb9592950a42946e959219c2d49ab7dfb29cc727b7f5b0e20dc9dfc523bbf0136d21517a7b99149ea6bdae0bbd3618f9e0b0a78

    • SSDEEP

      24576:IMc1bS0R6crXjYp36O1aNjoWBFJDq9SpCxfzs2o2SV/deDrgO:IMcxS0RTrzYp3/oNEWxq8pCRzro2SV/u

    Score
    10/10
    renamerdiscoveryworm

    • Detects Renamer worm.

      Renamer aka Grename is worm written in Delphi.

    • Renamer, Grenam

      Renamer aka Grenam is a worm written in Delphi.

      wormrenamer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks