Overview

overview

8

Static

static

7

1918dcaddf...18.dll

windows7-x64

8

1918dcaddf...18.dll

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1918dcaddf7e2da1e28f4f35902cb4d3_JaffaCakes118

  • Size

    60KB

  • Sample

    240628-g44jjsvgjb

  • MD5

    1918dcaddf7e2da1e28f4f35902cb4d3

  • SHA1

    1a63bfa971d4499c763b3c74d52968203742a17a

  • SHA256

    65d7531df5b656be92ad97261ab7cab732c16f7e328390d556d10ad8915f70ee

  • SHA512

    3c6ec132d9a9853e21d38d9b24995aea1bdbb00fb52afb6a69bb0afd3be150073830e0142ef0ba42a948c460503e2148d0d08cde429bd609e2f192acdb8ed9c5

  • SSDEEP

    1536:nJiYU3BtpCdtWMrd4IJfzc5TOtnVxhxMU:nJil3BHCdtWxSLMTOtVxgU

Score
8/10
persistenceprivilege_escalationvmprotect

Malware Config

Targets

    • Target

      1918dcaddf7e2da1e28f4f35902cb4d3_JaffaCakes118

    • Size

      60KB

    • MD5

      1918dcaddf7e2da1e28f4f35902cb4d3

    • SHA1

      1a63bfa971d4499c763b3c74d52968203742a17a

    • SHA256

      65d7531df5b656be92ad97261ab7cab732c16f7e328390d556d10ad8915f70ee

    • SHA512

      3c6ec132d9a9853e21d38d9b24995aea1bdbb00fb52afb6a69bb0afd3be150073830e0142ef0ba42a948c460503e2148d0d08cde429bd609e2f192acdb8ed9c5

    • SSDEEP

      1536:nJiYU3BtpCdtWMrd4IJfzc5TOtnVxhxMU:nJil3BHCdtWxSLMTOtVxgU

    Score
    8/10
    persistenceprivilege_escalationvmprotect

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

AppInit DLLs

1
T1546.010

Privilege Escalation

Event Triggered Execution

1
T1546

AppInit DLLs

1
T1546.010

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks