General

  • Target

    9dca9f65028c1eaed40a8cedbadadd98_JaffaCakes118

  • Size

    15.3MB

  • Sample

    240611-l14scstcjm

  • MD5

    9dca9f65028c1eaed40a8cedbadadd98

  • SHA1

    31482cff4f65698329764b65d3441786eb8dd9c7

  • SHA256

    1fb07da5da3994dd8f00723ce7dd6134c982ba0a738a23e1c8c61202c4dfedac

  • SHA512

    11a976a6f4283df1e172d7fc4bb2b5fb9472bef89b47bbf6d2b91f7b65d633dc3ff07496a0e873a42b7da58e67c18bfee452c95f7c558f0a2c371eb1fbb4209a

  • SSDEEP

    393216:vnNwp1jG94UpZ1Go+fP9dt2IZ9mOsDq/BQi:vNW1y7px6P9d0q9QDq/B

Malware Config

Targets

    • Target

      9dca9f65028c1eaed40a8cedbadadd98_JaffaCakes118

    • Size

      15.3MB

    • MD5

      9dca9f65028c1eaed40a8cedbadadd98

    • SHA1

      31482cff4f65698329764b65d3441786eb8dd9c7

    • SHA256

      1fb07da5da3994dd8f00723ce7dd6134c982ba0a738a23e1c8c61202c4dfedac

    • SHA512

      11a976a6f4283df1e172d7fc4bb2b5fb9472bef89b47bbf6d2b91f7b65d633dc3ff07496a0e873a42b7da58e67c18bfee452c95f7c558f0a2c371eb1fbb4209a

    • SSDEEP

      393216:vnNwp1jG94UpZ1Go+fP9dt2IZ9mOsDq/BQi:vNW1y7px6P9d0q9QDq/B

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Checks whether UAC is enabled

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks