Overview

overview

9

Static

static

3

61e6791d64...18.exe

windows7-x64

9

61e6791d64...18.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    61e6791d64367f33a26f725f58e43df3_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240521-d44yjagb65

  • MD5

    61e6791d64367f33a26f725f58e43df3

  • SHA1

    6585c78cc6bc0a9d4151bbf82e949ab343e607f7

  • SHA256

    025c621a1979cde664e15d07048cc6e6721b7fdab3ed6979f118e21799b441f1

  • SHA512

    3ddec9a197e7c1bc2085317dd62da95a4d5dd6f8ab26a257ad93f083681825f27276962b52563a7b1f2da6a5e13fa45acd1bb9135256b57f867145f878f82143

  • SSDEEP

    24576:vYAuh8qqqXdpaqJdrdyjYvWQKI/b3jLN/PX3YTyDhG:54q0dpaqJdrdycvWqV/PHYyD

Score
9/10
evasion

Malware Config

Targets

    • Target

      61e6791d64367f33a26f725f58e43df3_JaffaCakes118

    • Size

      1.1MB

    • MD5

      61e6791d64367f33a26f725f58e43df3

    • SHA1

      6585c78cc6bc0a9d4151bbf82e949ab343e607f7

    • SHA256

      025c621a1979cde664e15d07048cc6e6721b7fdab3ed6979f118e21799b441f1

    • SHA512

      3ddec9a197e7c1bc2085317dd62da95a4d5dd6f8ab26a257ad93f083681825f27276962b52563a7b1f2da6a5e13fa45acd1bb9135256b57f867145f878f82143

    • SSDEEP

      24576:vYAuh8qqqXdpaqJdrdyjYvWQKI/b3jLN/PX3YTyDhG:54q0dpaqJdrdycvWqV/PHYyD

    Score
    9/10
    evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks