79525c2360d5eb5b817a6ae852ab1daeb3de171f1fb04c3f67cc62b0cf78765e | Triage

Sharing

General

Target

735f2f3c0d78551946debbaae311ac44_JaffaCakes118
Size

2.5MB
Sample

240726-ktw89sxgnq
MD5

735f2f3c0d78551946debbaae311ac44
SHA1

0fbac06cea353237b488decd7fb172d8a4fdd1e6
SHA256

79525c2360d5eb5b817a6ae852ab1daeb3de171f1fb04c3f67cc62b0cf78765e
SHA512

556f89b7a61acf5226e5cc5845d146aff96d9f9e8ac8c6c7d53846c29d0679f24c5c0d4cf2e5bab70c2de3eb7472e43eec14953140bd8787a3a3f49bb1a84995
SSDEEP

49152:Mr1rcdfkbfLxGETDBIpnsZffVzTSXTkurhjDm8tcGU:UhuMjFVTK6SXTZtmmcGU

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  735f2f3c0d78551946debbaae311ac44_JaffaCakes118
- Size
  
  2.5MB
- MD5
  
  735f2f3c0d78551946debbaae311ac44
- SHA1
  
  0fbac06cea353237b488decd7fb172d8a4fdd1e6
- SHA256
  
  79525c2360d5eb5b817a6ae852ab1daeb3de171f1fb04c3f67cc62b0cf78765e
- SHA512
  
  556f89b7a61acf5226e5cc5845d146aff96d9f9e8ac8c6c7d53846c29d0679f24c5c0d4cf2e5bab70c2de3eb7472e43eec14953140bd8787a3a3f49bb1a84995
- SSDEEP
  
  49152:Mr1rcdfkbfLxGETDBIpnsZffVzTSXTkurhjDm8tcGU:UhuMjFVTK6SXTZtmmcGU
Score

10^/10

discovery evasion persistence
- Modifies WinLogon for persistence
  persistence
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Deletes itself
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Modifies WinLogon
  persistence
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasion