Overview

overview

10

Static

static

7

0e4119242e...18.exe

windows7-x64

10

0e4119242e...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0e4119242ecd2b48204c697a11595f98_JaffaCakes118

  • Size

    2.7MB

  • Sample

    240625-qrwgvasepg

  • MD5

    0e4119242ecd2b48204c697a11595f98

  • SHA1

    bf0848ff2a8fd223639916b33cb71136377a8986

  • SHA256

    8ba48377fe96fe2c99717b5b5f1c8df66226b96d87a46f4dbb361e9c1c61e612

  • SHA512

    62cea921c0545bbb3ef4a95ee9792c7ab27f01c547c3dee93cb5db9fc832113c26080b560133d73b87c0ffdde96bd7cf520a95456f7ad9fe79acfd62c70b9133

  • SSDEEP

    49152:FnX2elzv9gARZQFM5wo3kxP0p8qf9bbJ/KToQqB3v:TxHAMTkep8qFbEToQqB3v

Score
10/10
evasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      0e4119242ecd2b48204c697a11595f98_JaffaCakes118

    • Size

      2.7MB

    • MD5

      0e4119242ecd2b48204c697a11595f98

    • SHA1

      bf0848ff2a8fd223639916b33cb71136377a8986

    • SHA256

      8ba48377fe96fe2c99717b5b5f1c8df66226b96d87a46f4dbb361e9c1c61e612

    • SHA512

      62cea921c0545bbb3ef4a95ee9792c7ab27f01c547c3dee93cb5db9fc832113c26080b560133d73b87c0ffdde96bd7cf520a95456f7ad9fe79acfd62c70b9133

    • SSDEEP

      49152:FnX2elzv9gARZQFM5wo3kxP0p8qf9bbJ/KToQqB3v:TxHAMTkep8qFbEToQqB3v

    Score
    10/10
    evasionpersistencethemidatrojan

    • UAC bypass

      evasiontrojan

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

5
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks