da477cbd96f32b4e2c0f9ffdbaf7bf7f1bd8723a108210dcc7c1f2687ff16816 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a9866d27ef92c3e0d66fb44765fb0c5b_JaffaCakes118
Size

703KB
Sample

240819-ep1g8stbqa
MD5

a9866d27ef92c3e0d66fb44765fb0c5b
SHA1

06dc2103e5e9dd5c9453e4a4a09f334736772e46
SHA256

da477cbd96f32b4e2c0f9ffdbaf7bf7f1bd8723a108210dcc7c1f2687ff16816
SHA512

e9d1ac53ed0910306d43af32170da76dcb2c13336d364117618211d8e5d13f8c857e668a3414f20a2d7095a402b3fea3f0316970ff85396109737a78638d0cdd
SSDEEP

12288:c6JEYj++RMqx2719DdAGPg7Nv9herg6jvaIucELQr/tQmjoIGA1/I/H/qU:c6JEu++2qxuiwQgtAcEEr/pJGsKHC

Score

9^/10

discovery evasion

Malware Config

Targets

- Target
  
  a9866d27ef92c3e0d66fb44765fb0c5b_JaffaCakes118
- Size
  
  703KB
- MD5
  
  a9866d27ef92c3e0d66fb44765fb0c5b
- SHA1
  
  06dc2103e5e9dd5c9453e4a4a09f334736772e46
- SHA256
  
  da477cbd96f32b4e2c0f9ffdbaf7bf7f1bd8723a108210dcc7c1f2687ff16816
- SHA512
  
  e9d1ac53ed0910306d43af32170da76dcb2c13336d364117618211d8e5d13f8c857e668a3414f20a2d7095a402b3fea3f0316970ff85396109737a78638d0cdd
- SSDEEP
  
  12288:c6JEYj++RMqx2719DdAGPg7Nv9herg6jvaIucELQr/tQmjoIGA1/I/H/qU:c6JEu++2qxuiwQgtAcEEr/pJGsKHC
Score

9^/10

discovery evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasion

behavioral2

discoveryevasion