Overview

overview

7

Static

static

7

75202a0383...18.exe

windows7-x64

7

75202a0383...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    75202a0383aa9da7e32458304488fb16_JaffaCakes118

  • Size

    1.3MB

  • Sample

    240726-wl38dsveln

  • MD5

    75202a0383aa9da7e32458304488fb16

  • SHA1

    2e415b2d3814950145fcc2d6a677beb4b410acef

  • SHA256

    741691f64452fb4d36500bd617ec543e219d18dca7544d0e816e6219295b197f

  • SHA512

    efdbd5ab04fd09e6c740d20d68fb76388e5903e8a67c0963e0b4681fdcf50c74268ac8bdcf88e83a39f6c81471ad401823b423acebab87cf4aa0cd436d9f21c4

  • SSDEEP

    24576:EmWzQRHSmqXv6zQ3LKW+pBG2xOgCc9jqiAW056CmO3OFQTdD4wBwLUoq:EmWMRq6uKW+LG2xOgf9jqiOVlxUk

Score
7/10
discoveryevasionthemida

Malware Config

Targets

    • Target

      75202a0383aa9da7e32458304488fb16_JaffaCakes118

    • Size

      1.3MB

    • MD5

      75202a0383aa9da7e32458304488fb16

    • SHA1

      2e415b2d3814950145fcc2d6a677beb4b410acef

    • SHA256

      741691f64452fb4d36500bd617ec543e219d18dca7544d0e816e6219295b197f

    • SHA512

      efdbd5ab04fd09e6c740d20d68fb76388e5903e8a67c0963e0b4681fdcf50c74268ac8bdcf88e83a39f6c81471ad401823b423acebab87cf4aa0cd436d9f21c4

    • SSDEEP

      24576:EmWzQRHSmqXv6zQ3LKW+pBG2xOgCc9jqiAW056CmO3OFQTdD4wBwLUoq:EmWMRq6uKW+LG2xOgf9jqiOVlxUk

    Score
    7/10
    discoveryevasionthemida

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

1
T1012

Virtualization/Sandbox Evasion

1
T1497

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks