238bf03c48bb23cfa34fd97d062ce88b093e294c375c6c4302e592eb79f71a02 | Triage

Sharing

General

Target

81cae7a19295b5c206ef14d05408e79e_JaffaCakes118
Size

1.4MB
Sample

240801-1cdcts1dlg
MD5

81cae7a19295b5c206ef14d05408e79e
SHA1

9b0df840cc9f990b4fffaee63e5fe67cc1efa867
SHA256

238bf03c48bb23cfa34fd97d062ce88b093e294c375c6c4302e592eb79f71a02
SHA512

b090d4f168fd5cb38335815d4a6394aff11f0401ae8a9d893fd7626d892395c5e03fba3c942ba7aa8af87a6c6d74d87c3476a3d75e099b5e3e3f37f98a5cf380
SSDEEP

24576:jpmcsLiv18t8EJI639h4Ug7efYPZ6E2W0EjgoGxtau1NdX9r4aAZpN28:jkdL+CICM2WjgRtJ1jNkZ28

Score

9^/10

discovery evasion

Malware Config

Targets

- Target
  
  81cae7a19295b5c206ef14d05408e79e_JaffaCakes118
- Size
  
  1.4MB
- MD5
  
  81cae7a19295b5c206ef14d05408e79e
- SHA1
  
  9b0df840cc9f990b4fffaee63e5fe67cc1efa867
- SHA256
  
  238bf03c48bb23cfa34fd97d062ce88b093e294c375c6c4302e592eb79f71a02
- SHA512
  
  b090d4f168fd5cb38335815d4a6394aff11f0401ae8a9d893fd7626d892395c5e03fba3c942ba7aa8af87a6c6d74d87c3476a3d75e099b5e3e3f37f98a5cf380
- SSDEEP
  
  24576:jpmcsLiv18t8EJI639h4Ug7efYPZ6E2W0EjgoGxtau1NdX9r4aAZpN28:jkdL+CICM2WjgRtJ1jNkZ28
Score

9^/10

discovery evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasion

behavioral2

discoveryevasion