e47f60d3b07822177a85414289a0b23050fa7f908d2e17cc6fa5524f1d395cc4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

feb7cde4ed74c74e4b6b610930915d49_JaffaCakes118
Size

892KB
Sample

240421-hvnmeaeb3w
MD5

feb7cde4ed74c74e4b6b610930915d49
SHA1

9fe06de390cc11483a10e3101a7a1e62b8c4c62f
SHA256

e47f60d3b07822177a85414289a0b23050fa7f908d2e17cc6fa5524f1d395cc4
SHA512

bd9fe2627702211d5dc3a9db020757b0e69a57b1bd7dd9e1588b68d7be3c3d4a4c7292acd8f461ba2df19adbdfb6cc7586c26459ff3d123f448a9575f622906c
SSDEEP

24576:tqbIdkB4D8j+SagUvY7L5lGVWFcuQcJhActOjNW7Bf8+:mIWMPvbVq3JojNWVL

Score

7^/10

evasion trojan

Malware Config

Targets

- Target
  
  feb7cde4ed74c74e4b6b610930915d49_JaffaCakes118
- Size
  
  892KB
- MD5
  
  feb7cde4ed74c74e4b6b610930915d49
- SHA1
  
  9fe06de390cc11483a10e3101a7a1e62b8c4c62f
- SHA256
  
  e47f60d3b07822177a85414289a0b23050fa7f908d2e17cc6fa5524f1d395cc4
- SHA512
  
  bd9fe2627702211d5dc3a9db020757b0e69a57b1bd7dd9e1588b68d7be3c3d4a4c7292acd8f461ba2df19adbdfb6cc7586c26459ff3d123f448a9575f622906c
- SSDEEP
  
  24576:tqbIdkB4D8j+SagUvY7L5lGVWFcuQcJhActOjNW7Bf8+:mIWMPvbVq3JojNWVL
Score

7^/10

evasion trojan
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2