Overview

overview

8

Static

static

7

010ffeb551...18.exe

windows7-x64

8

010ffeb551...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    010ffeb55138be8fc6e77ed64a49ea66_JaffaCakes118

  • Size

    2.5MB

  • Sample

    240619-237j2azhlp

  • MD5

    010ffeb55138be8fc6e77ed64a49ea66

  • SHA1

    22b52a209f208800bea96ff991d333c9f678981a

  • SHA256

    536514bd979822b84b067b34d1a16228e439e38f8ef5a27a540d61825487d0b2

  • SHA512

    403d70678d0e02e84cf91231b6eec35f64523e86c5aacfab8fb6ec7dfcf91eb8d50e1698f05433a362726c0f494bb764b8364f4a00879143954b9e9a9f2a20af

  • SSDEEP

    49152:QfTmKh1BH+hh49W4hAszr0zvHjuZFEQCpmg5uj57pkC5/ElRKL8JqKAC:QrmKh1QUw+vMFLG57pkCpqKW

Score
8/10
evasionpersistenceprivilege_escalationthemida

Malware Config

Targets

    • Target

      010ffeb55138be8fc6e77ed64a49ea66_JaffaCakes118

    • Size

      2.5MB

    • MD5

      010ffeb55138be8fc6e77ed64a49ea66

    • SHA1

      22b52a209f208800bea96ff991d333c9f678981a

    • SHA256

      536514bd979822b84b067b34d1a16228e439e38f8ef5a27a540d61825487d0b2

    • SHA512

      403d70678d0e02e84cf91231b6eec35f64523e86c5aacfab8fb6ec7dfcf91eb8d50e1698f05433a362726c0f494bb764b8364f4a00879143954b9e9a9f2a20af

    • SSDEEP

      49152:QfTmKh1BH+hh49W4hAszr0zvHjuZFEQCpmg5uj57pkC5/ElRKL8JqKAC:QrmKh1QUw+vMFLG57pkCpqKW

    Score
    8/10
    evasionpersistenceprivilege_escalationthemida

    • Modifies Windows Firewall

      evasion

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

2
T1112

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks