0b6d15238b5a7e3d580e24871495019c2186149b3d7dbe2d9bf0668ed50749d0 | Triage

Sharing

General

Target

40688d57a661fd9fb32ef00b760777d2_JaffaCakes118
Size

815KB
Sample

240713-gea6pszgkd
MD5

40688d57a661fd9fb32ef00b760777d2
SHA1

c6bffc1e1d1416357017d38ff9a2bc04d87ce125
SHA256

0b6d15238b5a7e3d580e24871495019c2186149b3d7dbe2d9bf0668ed50749d0
SHA512

990e1004d488fabf0b0b72172f1bf1f41c6df48277703f363f891ad21bef8de6a9ad8fa69f53c55825d16df68eabcc0896319d2cde7d670c312d252cf5cbf5e5
SSDEEP

12288:IE3YeiDFvZrO2tN/x2Gy7+5dmhMsiHAmZ6QG9WIBwXwprnkFtEI4IAH43PorUPnV:cvI2RryuLjZMWuw0rka4/o4SNid

Score

9^/10

evasion trojan

Malware Config

Targets

- Target
  
  40688d57a661fd9fb32ef00b760777d2_JaffaCakes118
- Size
  
  815KB
- MD5
  
  40688d57a661fd9fb32ef00b760777d2
- SHA1
  
  c6bffc1e1d1416357017d38ff9a2bc04d87ce125
- SHA256
  
  0b6d15238b5a7e3d580e24871495019c2186149b3d7dbe2d9bf0668ed50749d0
- SHA512
  
  990e1004d488fabf0b0b72172f1bf1f41c6df48277703f363f891ad21bef8de6a9ad8fa69f53c55825d16df68eabcc0896319d2cde7d670c312d252cf5cbf5e5
- SSDEEP
  
  12288:IE3YeiDFvZrO2tN/x2Gy7+5dmhMsiHAmZ6QG9WIBwXwprnkFtEI4IAH43PorUPnV:cvI2RryuLjZMWuw0rka4/o4SNid
Score

9^/10

evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Deletes itself
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2