Overview

overview

10

Static

static

3

JaffaCakes...41.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    JaffaCakes118_285ad15f80ba5e1dd0b4f726dcfa4341
  • Size 769KB
  • Sample250814-rmtccsak2x
  • SHA256 96d5f4bfa70933e2526c0f6a122501153926a1ef742e30c8455051b0480f0559
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
renamerdiscoveryexecutionworm

Malware Config

Targets

    • Target
      JaffaCakes118_285ad15f80ba5e1dd0b4f726dcfa4341
    • Size 769KB
    • SHA256 96d5f4bfa70933e2526c0f6a122501153926a1ef742e30c8455051b0480f0559
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    renamerdiscoveryexecutionworm

    • Detects Renamer worm.

      Renamer aka Grename is worm written in Delphi.

    • Renamer family

      renamer

    • Renamer, Grenam

      Renamer aka Grenam is a worm written in Delphi.

      wormrenamer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks