e447a17edabe3d84d5f3e641ab2f8e286e558de557c4b6ac31609196e191b721 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

71ebe764e3d5bf454effa5ab2361b0d9_JaffaCakes118
Size

2.8MB
Sample

240726-a1rbgsvfnr
MD5

71ebe764e3d5bf454effa5ab2361b0d9
SHA1

33865faa2d0b95454a976e3e1232bddb496043d1
SHA256

e447a17edabe3d84d5f3e641ab2f8e286e558de557c4b6ac31609196e191b721
SHA512

455ced4767829bf48caaeebbaa57c6b694989a9d61d5f630d896557411783de4ebfe9cef37bc5addc35d657754d23d33eebb8ca6345ffe5b5b590e8adedf8638
SSDEEP

49152:Jpsr9H3x2jDZnoxiGhDLYG4i4FyXrrrM837zAwUherCyIaPyjyWvwjI6lKBBUtNc:J09H3x2jDZnoxiGhDLYG4i4FyXrrrM80

Score

7^/10

discovery evasion

Malware Config

Targets

- Target
  
  71ebe764e3d5bf454effa5ab2361b0d9_JaffaCakes118
- Size
  
  2.8MB
- MD5
  
  71ebe764e3d5bf454effa5ab2361b0d9
- SHA1
  
  33865faa2d0b95454a976e3e1232bddb496043d1
- SHA256
  
  e447a17edabe3d84d5f3e641ab2f8e286e558de557c4b6ac31609196e191b721
- SHA512
  
  455ced4767829bf48caaeebbaa57c6b694989a9d61d5f630d896557411783de4ebfe9cef37bc5addc35d657754d23d33eebb8ca6345ffe5b5b590e8adedf8638
- SSDEEP
  
  49152:Jpsr9H3x2jDZnoxiGhDLYG4i4FyXrrrM837zAwUherCyIaPyjyWvwjI6lKBBUtNc:J09H3x2jDZnoxiGhDLYG4i4FyXrrrM80
Score

7^/10

discovery evasion
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasion

behavioral2

discoveryevasion