42efc7df5c7fd042091bdba1385a13facb0e776764740e455db6a622ffd3f841 | Triage

Sharing

General

Target

49233959cd0dffc71cd7122fa78ca8af_JaffaCakes118
Size

864KB
Sample

240715-k4q51a1hlg
MD5

49233959cd0dffc71cd7122fa78ca8af
SHA1

1593e63e202e4cd36e5c4922b4b665b9018dc820
SHA256

42efc7df5c7fd042091bdba1385a13facb0e776764740e455db6a622ffd3f841
SHA512

b3940eef47227e0f076ea8a55284995372208f689f4dcdb538bc3aab812376f5239798b0b45a2be46e302e6879bb32aedeff89690ed0fb7888e51e3f05ecd4f6
SSDEEP

12288:4X+ftNo5zUO3/E8hYAKGQ9iB2iTMqrx7mMPScqVFdWarj/QJB3OF7gT757Z7ip:nftN1H8hYGakp5hWVPWrJEF7gL7ip

Score

7^/10

evasion trojan

Malware Config

Targets

- Target
  
  49233959cd0dffc71cd7122fa78ca8af_JaffaCakes118
- Size
  
  864KB
- MD5
  
  49233959cd0dffc71cd7122fa78ca8af
- SHA1
  
  1593e63e202e4cd36e5c4922b4b665b9018dc820
- SHA256
  
  42efc7df5c7fd042091bdba1385a13facb0e776764740e455db6a622ffd3f841
- SHA512
  
  b3940eef47227e0f076ea8a55284995372208f689f4dcdb538bc3aab812376f5239798b0b45a2be46e302e6879bb32aedeff89690ed0fb7888e51e3f05ecd4f6
- SSDEEP
  
  12288:4X+ftNo5zUO3/E8hYAKGQ9iB2iTMqrx7mMPScqVFdWarj/QJB3OF7gT757Z7ip:nftN1H8hYGakp5hWVPWrJEF7gL7ip
Score

7^/10

evasion trojan
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2