Overview

overview

10

Static

static

3

7b13d92a5b...18.exe

windows7-x64

7

7b13d92a5b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7b13d92a5bfc7ee0ee5d9c86eb07ce23_JaffaCakes118

  • Size

    1.2MB

  • Sample

    241028-3hg93sxpbt

  • MD5

    7b13d92a5bfc7ee0ee5d9c86eb07ce23

  • SHA1

    c2f5566d2a142388b9b7887c6e86ad9c619f8003

  • SHA256

    0e4e50cd144c54ef6eaae2464d15977f3b60b2001118cfe6392731ccc671137c

  • SHA512

    9e824a2ea95ffae8da28ec88ca6288250681a6064b8ac61210d12382f798121466d688ded6d18add1ddb85463a793d7b92cd97b13369598d832a1f6138600de1

  • SSDEEP

    24576:Rj/ZAILiXtDtrn+LCHVYmpRqQYAe9GIdUfd40Qb4B/cWy52:RT+gibn++HV3pcQY7bdU1Qu/BM2

Score
10/10
renamerdiscoverypersistenceworm

Malware Config

Targets

    • Target

      7b13d92a5bfc7ee0ee5d9c86eb07ce23_JaffaCakes118

    • Size

      1.2MB

    • MD5

      7b13d92a5bfc7ee0ee5d9c86eb07ce23

    • SHA1

      c2f5566d2a142388b9b7887c6e86ad9c619f8003

    • SHA256

      0e4e50cd144c54ef6eaae2464d15977f3b60b2001118cfe6392731ccc671137c

    • SHA512

      9e824a2ea95ffae8da28ec88ca6288250681a6064b8ac61210d12382f798121466d688ded6d18add1ddb85463a793d7b92cd97b13369598d832a1f6138600de1

    • SSDEEP

      24576:Rj/ZAILiXtDtrn+LCHVYmpRqQYAe9GIdUfd40Qb4B/cWy52:RT+gibn++HV3pcQY7bdU1Qu/BM2

    Score
    10/10
    discoverypersistencerenamerworm

    • Detects Renamer worm.

      Renamer aka Grename is worm written in Delphi.

    • Renamer family

      renamer

    • Renamer, Grenam

      Renamer aka Grenam is a worm written in Delphi.

      wormrenamer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks