f178506baf568a80ca371e2a0b78287e1e007c577a540bf0bf4b47ea9242f15b | Triage

Sharing

General

Target

20a593c3191819c317ebec02b91bea06_JaffaCakes118
Size

203KB
Sample

240507-qa283abd97
MD5

20a593c3191819c317ebec02b91bea06
SHA1

1dd2075cc22c5046378ae4e52e7fdf93239a3cab
SHA256

f178506baf568a80ca371e2a0b78287e1e007c577a540bf0bf4b47ea9242f15b
SHA512

2b02c02ba73b9f09c1a2ab3174c8c4c693fcbea46f694216c592f7a198bc49a70f61dec756efa12ec8213174abc9915c1904a8100df4498c66b51f7ed4376054
SSDEEP

6144:JCkWKpuCstx5AR8YBz0u0WVBO9uYjj46DyD0ej2om:JCkWMzsf5Zo4sYjk6CF2om

Score

7^/10

evasion persistence

Malware Config

Targets

- Target
  
  20a593c3191819c317ebec02b91bea06_JaffaCakes118
- Size
  
  203KB
- MD5
  
  20a593c3191819c317ebec02b91bea06
- SHA1
  
  1dd2075cc22c5046378ae4e52e7fdf93239a3cab
- SHA256
  
  f178506baf568a80ca371e2a0b78287e1e007c577a540bf0bf4b47ea9242f15b
- SHA512
  
  2b02c02ba73b9f09c1a2ab3174c8c4c693fcbea46f694216c592f7a198bc49a70f61dec756efa12ec8213174abc9915c1904a8100df4498c66b51f7ed4376054
- SSDEEP
  
  6144:JCkWKpuCstx5AR8YBz0u0WVBO9uYjj46DyD0ej2om:JCkWMzsf5Zo4sYjk6CF2om
Score

7^/10

evasion persistence
- Deletes itself
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2