Overview

overview

9

Static

static

3

1873f7771e...18.exe

windows7-x64

9

1873f7771e...18.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    1873f7771eed44053c81cb0dd84bfbfb_JaffaCakes118

  • Size

    989KB

  • Sample

    240628-cw1epswepe

  • MD5

    1873f7771eed44053c81cb0dd84bfbfb

  • SHA1

    211592188f0499811521372d20f1b942bf33d70c

  • SHA256

    ff4c13e12fc66b72bd63ce1458da73f4c3667d9c4e944180c4d01154f2b0bfdc

  • SHA512

    e6cb7dd73d93a7a74a65bbe80e6a4ff6f3e6e940ee0e3b9ca85c3eebc3292b71150b070497f08c3cfe836c0cbea19a3dadeb8d4b6bc8c990630acc9a1394cabe

  • SSDEEP

    24576:k7uENbxIk+ngDdxYnugJqBtOYLn4lQ3w2:kjIktRSnugIBt73

Score
9/10
evasion

Malware Config

Targets

    • Target

      1873f7771eed44053c81cb0dd84bfbfb_JaffaCakes118

    • Size

      989KB

    • MD5

      1873f7771eed44053c81cb0dd84bfbfb

    • SHA1

      211592188f0499811521372d20f1b942bf33d70c

    • SHA256

      ff4c13e12fc66b72bd63ce1458da73f4c3667d9c4e944180c4d01154f2b0bfdc

    • SHA512

      e6cb7dd73d93a7a74a65bbe80e6a4ff6f3e6e940ee0e3b9ca85c3eebc3292b71150b070497f08c3cfe836c0cbea19a3dadeb8d4b6bc8c990630acc9a1394cabe

    • SSDEEP

      24576:k7uENbxIk+ngDdxYnugJqBtOYLn4lQ3w2:kjIktRSnugIBt73

    Score
    9/10
    evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks