3cf06dc740759f4ca926649729465a3782d16e742c1f21329d029f43f045e97d | Triage

Sharing

General

Target

81c6bda2e9a11f1992063b05980f71da_JaffaCakes118
Size

816KB
Sample

240801-z7n75s1bpg
MD5

81c6bda2e9a11f1992063b05980f71da
SHA1

d34b41a72f469208e6429c06e40fed461e377825
SHA256

3cf06dc740759f4ca926649729465a3782d16e742c1f21329d029f43f045e97d
SHA512

6bd11cc620c004bcc195e88b070421d560fdb3c69e7d6dc68b5eb53b819dbc05498f16a9f4e79163ea65e36e9b07344c8748da4325a91b0b5d4493fadab1262f
SSDEEP

12288:6H/GXgymsGaH6NxsuN7pfC5hH22nIZroYYngbanDkqu0n/jB2hYVAW:+uXgXJN2x5N26kCgu4JyzSW

Score

9^/10

discovery evasion

Malware Config

Targets

- Target
  
  81c6bda2e9a11f1992063b05980f71da_JaffaCakes118
- Size
  
  816KB
- MD5
  
  81c6bda2e9a11f1992063b05980f71da
- SHA1
  
  d34b41a72f469208e6429c06e40fed461e377825
- SHA256
  
  3cf06dc740759f4ca926649729465a3782d16e742c1f21329d029f43f045e97d
- SHA512
  
  6bd11cc620c004bcc195e88b070421d560fdb3c69e7d6dc68b5eb53b819dbc05498f16a9f4e79163ea65e36e9b07344c8748da4325a91b0b5d4493fadab1262f
- SSDEEP
  
  12288:6H/GXgymsGaH6NxsuN7pfC5hH22nIZroYYngbanDkqu0n/jB2hYVAW:+uXgXJN2x5N26kCgu4JyzSW
Score

9^/10

discovery evasion
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Enumerates VirtualBox registry keys
  evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Software Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasion

behavioral2