General

  • Target

    e9321013d5acb2c4748e1fdc73eaf3b1_JaffaCakes118

  • Size

    17.7MB

  • Sample

    240409-esw9zshg8v

  • MD5

    e9321013d5acb2c4748e1fdc73eaf3b1

  • SHA1

    7df06af133a590e7c080e3c3fdaa69b0a9452173

  • SHA256

    1ae8772c13e7a78e8426aaf37a834ef0637f1897f006c457e0ebaf761fb6f203

  • SHA512

    0b6402bb099e4bc1a73f3b437ef386aa97a0213ff2d3e14cfd727c5928da89561037d1b4d25bd343091c38a47958693dc74ecac8b34926c8e9883f83205e7d03

  • SSDEEP

    393216:8l3zl32nC/Oq0nyLo+cr7TjZSOo208ozQwfq4p4X1rvARQibF:VCB0nJjZ4208dwV4FvARj

Malware Config

Targets

    • Target

      e9321013d5acb2c4748e1fdc73eaf3b1_JaffaCakes118

    • Size

      17.7MB

    • MD5

      e9321013d5acb2c4748e1fdc73eaf3b1

    • SHA1

      7df06af133a590e7c080e3c3fdaa69b0a9452173

    • SHA256

      1ae8772c13e7a78e8426aaf37a834ef0637f1897f006c457e0ebaf761fb6f203

    • SHA512

      0b6402bb099e4bc1a73f3b437ef386aa97a0213ff2d3e14cfd727c5928da89561037d1b4d25bd343091c38a47958693dc74ecac8b34926c8e9883f83205e7d03

    • SSDEEP

      393216:8l3zl32nC/Oq0nyLo+cr7TjZSOo208ozQwfq4p4X1rvARQibF:VCB0nJjZ4208dwV4FvARj

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks