15a360d9adf737f50d4fb87b9f5806d668ca0b97f6254a66abc302ab9424b80f | Triage

Sharing

General

Target

a0a9d37ad23e44d622509cf34592309c_JaffaCakes118
Size

815KB
Sample

240817-blsfnssank
MD5

a0a9d37ad23e44d622509cf34592309c
SHA1

17f2210b1fcbae17806e094718dda34cc428d5cf
SHA256

15a360d9adf737f50d4fb87b9f5806d668ca0b97f6254a66abc302ab9424b80f
SHA512

3adc66553f2436d031abc7d24429d208b2502a74c20689308d6ee3425452633183115cf5d25f6ee2371eb109ef1c8ab5e59ff6e7d4baccfa1133755f6f270265
SSDEEP

12288:V/C7wR3t7ZESttwWYSIk9/LjMiS59VZsPH5HLjC6mW0EZ9ty4B8WYrQvlPYPOQ3x:8UrYSIkxvMV5Cv5rjC6mWZ9cWYCwPp5r

Score

9^/10

discovery evasion

Malware Config

Targets

- Target
  
  a0a9d37ad23e44d622509cf34592309c_JaffaCakes118
- Size
  
  815KB
- MD5
  
  a0a9d37ad23e44d622509cf34592309c
- SHA1
  
  17f2210b1fcbae17806e094718dda34cc428d5cf
- SHA256
  
  15a360d9adf737f50d4fb87b9f5806d668ca0b97f6254a66abc302ab9424b80f
- SHA512
  
  3adc66553f2436d031abc7d24429d208b2502a74c20689308d6ee3425452633183115cf5d25f6ee2371eb109ef1c8ab5e59ff6e7d4baccfa1133755f6f270265
- SSDEEP
  
  12288:V/C7wR3t7ZESttwWYSIk9/LjMiS59VZsPH5HLjC6mW0EZ9ty4B8WYrQvlPYPOQ3x:8UrYSIkxvMV5Cv5rjC6mWZ9cWYCwPp5r
Score

9^/10

discovery evasion
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Enumerates VirtualBox registry keys
  evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Software Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasion

behavioral2