Overview

overview

9

Static

static

3

875e3b18fe...18.exe

windows7-x64

9

875e3b18fe...18.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    875e3b18fe74c765f95011365f53fee5_JaffaCakes118

  • Size

    1.8MB

  • Sample

    240531-r44jnabg2t

  • MD5

    875e3b18fe74c765f95011365f53fee5

  • SHA1

    5cdba5188a445bc214ed4c7c3af565ad702a27b7

  • SHA256

    511c11131e2d7534da282e92c16ac7a69a03ce6a92192a7e1f65dfea2a2e7e60

  • SHA512

    bcc2d0b7290fb6e618e54985ce7c0d42bc122252e02335e3953c2651ff75ed6104e6e17dc1224af431b82c4b1eb7f46238d0e910f6dcf8c91d987a6db5dc1d16

  • SSDEEP

    24576:F7pqUy5IwH67zglcR5/tnWa9cIBc5ms7tCMduN2dUQOyrhd93J16ytFdGfXnN8S9:9sm+ulnvByMAeCa0d9H6yZOXPFo/E4Q

Score
9/10
evasion

Malware Config

Targets

    • Target

      875e3b18fe74c765f95011365f53fee5_JaffaCakes118

    • Size

      1.8MB

    • MD5

      875e3b18fe74c765f95011365f53fee5

    • SHA1

      5cdba5188a445bc214ed4c7c3af565ad702a27b7

    • SHA256

      511c11131e2d7534da282e92c16ac7a69a03ce6a92192a7e1f65dfea2a2e7e60

    • SHA512

      bcc2d0b7290fb6e618e54985ce7c0d42bc122252e02335e3953c2651ff75ed6104e6e17dc1224af431b82c4b1eb7f46238d0e910f6dcf8c91d987a6db5dc1d16

    • SSDEEP

      24576:F7pqUy5IwH67zglcR5/tnWa9cIBc5ms7tCMduN2dUQOyrhd93J16ytFdGfXnN8S9:9sm+ulnvByMAeCa0d9H6yZOXPFo/E4Q

    Score
    9/10
    evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks