f5aadba145d1ca3ee53dc72a17979af6d5324c728f1364879ca64ed75d8e5a25 | Triage

Sharing

General

Target

a023c76a7558d2207be6f1dfd76ad463_JaffaCakes118
Size

1003KB
Sample

240816-15m3qszgqg
MD5

a023c76a7558d2207be6f1dfd76ad463
SHA1

7a00b4a079b93020b690b224555e23873375d9dc
SHA256

f5aadba145d1ca3ee53dc72a17979af6d5324c728f1364879ca64ed75d8e5a25
SHA512

8f876821d1cc5af9c2930105d4b5e1cfd057ca7cd732a9d484834d6820aee0c8cde34bbf208bbb2802f99e5fbf23c6a9b36b15b0955b6f5c5422e79503a8d8d9
SSDEEP

24576:0AjIS7NqOHPD5GqjaSwS0l5/rXoavbg5aF9ppKJooQAe:0pQNqEsqWSw3l5sibh9ppKJtQJ

Score

9^/10

discovery evasion

Malware Config

Targets

- Target
  
  a023c76a7558d2207be6f1dfd76ad463_JaffaCakes118
- Size
  
  1003KB
- MD5
  
  a023c76a7558d2207be6f1dfd76ad463
- SHA1
  
  7a00b4a079b93020b690b224555e23873375d9dc
- SHA256
  
  f5aadba145d1ca3ee53dc72a17979af6d5324c728f1364879ca64ed75d8e5a25
- SHA512
  
  8f876821d1cc5af9c2930105d4b5e1cfd057ca7cd732a9d484834d6820aee0c8cde34bbf208bbb2802f99e5fbf23c6a9b36b15b0955b6f5c5422e79503a8d8d9
- SSDEEP
  
  24576:0AjIS7NqOHPD5GqjaSwS0l5/rXoavbg5aF9ppKJooQAe:0pQNqEsqWSw3l5sibh9ppKJtQJ
Score

9^/10

discovery evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasion

behavioral2

discoveryevasion