a97ead7645f4d9aea1e7ceccd023251fdaef68f9a47396dce2927411d6954e9f | Triage

Sharing

General

Target

ed7288bc8b1099f5c578eec8949265e5_JaffaCakes118
Size

5.5MB
Sample

240411-pw76rseh2x
MD5

ed7288bc8b1099f5c578eec8949265e5
SHA1

35ce20a445a42a6e2c83dde460fffc724193119a
SHA256

a97ead7645f4d9aea1e7ceccd023251fdaef68f9a47396dce2927411d6954e9f
SHA512

7c34603c85c10e8ff4ebec894b53e5b619eb0f040491e8e42fe33b7d4c8ac783b55896571d071ffd52eaaf900d90041dc633fca84f38a8f93c8f488cd62085ff
SSDEEP

98304:Cb5tK7eL0MnxfuD26M8pfVAIFQP5Q/ZjTtHuI28GSd3YPnvW8yrNpm1trn:OKaL0MxfmjfnMuxTtOI28GSd3YXgP8tj

Score

9^/10

evasion trojan

Malware Config

Targets

- Target
  
  ed7288bc8b1099f5c578eec8949265e5_JaffaCakes118
- Size
  
  5.5MB
- MD5
  
  ed7288bc8b1099f5c578eec8949265e5
- SHA1
  
  35ce20a445a42a6e2c83dde460fffc724193119a
- SHA256
  
  a97ead7645f4d9aea1e7ceccd023251fdaef68f9a47396dce2927411d6954e9f
- SHA512
  
  7c34603c85c10e8ff4ebec894b53e5b619eb0f040491e8e42fe33b7d4c8ac783b55896571d071ffd52eaaf900d90041dc633fca84f38a8f93c8f488cd62085ff
- SSDEEP
  
  98304:Cb5tK7eL0MnxfuD26M8pfVAIFQP5Q/ZjTtHuI28GSd3YPnvW8yrNpm1trn:OKaL0MxfmjfnMuxTtOI28GSd3YXgP8tj
Score

9^/10

evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2