General
-
Target
JaffaCakes118_8bbcaa08f92a14c34530dcccf8a0e495
-
Size
816KB
-
Sample
250329-vls7razry5
-
MD5
8bbcaa08f92a14c34530dcccf8a0e495
-
SHA1
a81533447e350db90507b54490c821531f9fbc69
-
SHA256
2812cb2490f12a37dc179559ed92d77db00ac0ea67e44d0c17185627bcb006e3
-
SHA512
c6e6556264921e9eae4b2cabe3d4a7f57748e3e5625fcf0e48af714840c436f6e38be94caf32104538f7329b2fcdafa288d04373c66fdeaa0590e956531fea6d
-
SSDEEP
12288:gqkAx8i7pC8PapFTUt6xIuFrb9OKcEKfBKSNqvnSNgFCV4tuR8888888888888WX:N8i7pjPapFTUt6xIyHGBKSNqvn5m4tkh
Malware Config
Targets
-
-
Target
JaffaCakes118_8bbcaa08f92a14c34530dcccf8a0e495
-
Size
816KB
-
MD5
8bbcaa08f92a14c34530dcccf8a0e495
-
SHA1
a81533447e350db90507b54490c821531f9fbc69
-
SHA256
2812cb2490f12a37dc179559ed92d77db00ac0ea67e44d0c17185627bcb006e3
-
SHA512
c6e6556264921e9eae4b2cabe3d4a7f57748e3e5625fcf0e48af714840c436f6e38be94caf32104538f7329b2fcdafa288d04373c66fdeaa0590e956531fea6d
-
SSDEEP
12288:gqkAx8i7pC8PapFTUt6xIuFrb9OKcEKfBKSNqvnSNgFCV4tuR8888888888888WX:N8i7pjPapFTUt6xIyHGBKSNqvn5m4tkh
Score10/10-
Detects Renamer worm.
Renamer aka Grename is worm written in Delphi.
-
Renamer family
-
Renamer, Grenam
Renamer aka Grenam is a worm written in Delphi.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1