Overview

overview

9

Static

static

3

WinLockDll.dll

windows7-x64

9

WinLockDll.dll

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    f99bdd7bf29c219400f3264f73a75eb5_JaffaCakes118

  • Size

    751KB

  • Sample

    240419-f8qb2saa94

  • MD5

    f99bdd7bf29c219400f3264f73a75eb5

  • SHA1

    593bb63cfda50cf6c46cc33491d7ce11b95e36c0

  • SHA256

    12713745be840db8189ba6b3fa17210d414bacd20c4b98e07338c6889cf434c1

  • SHA512

    5918370a98a6a69285b5daf5797474803b7653cdd449345bfd43564a951859fd4cc23b3cd149ac5a143d3ed58774b902f2f5a7ca6cab3921198bb7b38fea3b6f

  • SSDEEP

    12288:F4RqDpk3XHO3FS6HBIvL8hHdatGfLOJQ0aRHz9loLCo/Bj/:sqeEFS6HsYnat1Q0gHzOCKBL

Score
9/10
evasion

Malware Config

Targets

    • Target

      WinLockDll.dll

    • Size

      762KB

    • MD5

      02add961e8246d96789f24e96e812c8e

    • SHA1

      b3f86e4772eab477921a7c0e4fe3db726a0fe338

    • SHA256

      8d0d78a8742666af5a3fefaf1f63ae0cb476d1da0a28732b7544365fa773a788

    • SHA512

      2db9fc786cb080e3d157640a111f9c001f0e8cb2450b8b55f0c8e3dfb24e6eb4e335cf42a8266354da0e67e22a4dd723281a7730a1a8fa31514228f8b642f5d6

    • SSDEEP

      12288:g/bLxfel8/OC+OAjCVverv857U9IZpRaMX7zYLw6hm3gnBhdbyWA67l9ZClKMFIm:g/xx/OBO3GqUWRHlW6wcZYDgobm

    Score
    9/10
    evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks