ebcdf85a377159abb6f53a3db5d2d8b4bc31ac3621720000c8f03e59cb5f67e2 | Triage

Sharing

General

Target

3651a782220139f294a583fc8c0438c8_JaffaCakes118
Size

961KB
Sample

240710-zk7e7s1gqf
MD5

3651a782220139f294a583fc8c0438c8
SHA1

6b7bf82eac9423122ea16eed80a19989aebf72c1
SHA256

ebcdf85a377159abb6f53a3db5d2d8b4bc31ac3621720000c8f03e59cb5f67e2
SHA512

db715897fd45abb2a11e432bccf25da7f87838224a0d2d223244dbb1c012185761f052d96a80f2cf4c1664de99f304617969a794d506d16bc4d062a87c8125cb
SSDEEP

24576:vu3S7wjbc02H7lT7MnP2r3enbzbecCG6zq:GiEjwVH7lT7MnPcunbFCHG

Score

7^/10

evasion trojan

Malware Config

Targets

- Target
  
  3651a782220139f294a583fc8c0438c8_JaffaCakes118
- Size
  
  961KB
- MD5
  
  3651a782220139f294a583fc8c0438c8
- SHA1
  
  6b7bf82eac9423122ea16eed80a19989aebf72c1
- SHA256
  
  ebcdf85a377159abb6f53a3db5d2d8b4bc31ac3621720000c8f03e59cb5f67e2
- SHA512
  
  db715897fd45abb2a11e432bccf25da7f87838224a0d2d223244dbb1c012185761f052d96a80f2cf4c1664de99f304617969a794d506d16bc4d062a87c8125cb
- SSDEEP
  
  24576:vu3S7wjbc02H7lT7MnP2r3enbzbecCG6zq:GiEjwVH7lT7MnPcunbFCHG
Score

7^/10

evasion trojan
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2