Overview

overview

10

Static

static

3

18212bd79c...18.exe

windows7-x64

10

18212bd79c...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    18212bd79c59c5e1d8a65198d3748371_JaffaCakes118

  • Size

    2.1MB

  • Sample

    240505-rydfaafh65

  • MD5

    18212bd79c59c5e1d8a65198d3748371

  • SHA1

    9ff4956462b46da2ecf4ac9a9b4fafa2914a17cd

  • SHA256

    236798230024a7164aa432c8c2420a7aeb3d1cdbea076b29566cf6355a2465b6

  • SHA512

    1051ef696456785dc5b307914d282a93d0be0aad480d18411dacd97038859bd2b7393e038a704a0badf2a6ca2492a768029c65a70492b1b972637cba64acfda7

  • SSDEEP

    49152:b2v4E+XLxk0eGrkhd7GZtT01Ys6ycGGYQ2Vo:04TX5XkPqT06sUGGYQKo

Score
10/10
evasion

Malware Config

Targets

    • Target

      18212bd79c59c5e1d8a65198d3748371_JaffaCakes118

    • Size

      2.1MB

    • MD5

      18212bd79c59c5e1d8a65198d3748371

    • SHA1

      9ff4956462b46da2ecf4ac9a9b4fafa2914a17cd

    • SHA256

      236798230024a7164aa432c8c2420a7aeb3d1cdbea076b29566cf6355a2465b6

    • SHA512

      1051ef696456785dc5b307914d282a93d0be0aad480d18411dacd97038859bd2b7393e038a704a0badf2a6ca2492a768029c65a70492b1b972637cba64acfda7

    • SSDEEP

      49152:b2v4E+XLxk0eGrkhd7GZtT01Ys6ycGGYQ2Vo:04TX5XkPqT06sUGGYQKo

    Score
    10/10
    evasion

    • Modifies visibility of file extensions in Explorer

      evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks