c85ac1cd2cd5d00dd21d6a08c88bb2f4fd92ceb31c8a324788200dc956ab46f8 | Triage

Sharing

General

Target

bb97c65a7356aebabd0305888eeb8699_JaffaCakes118
Size

510KB
Sample

240823-nwphzssalc
MD5

bb97c65a7356aebabd0305888eeb8699
SHA1

2d966f8c24e22cae7d6c52d7606e191158367e84
SHA256

c85ac1cd2cd5d00dd21d6a08c88bb2f4fd92ceb31c8a324788200dc956ab46f8
SHA512

6d9042b1a1c67b601cf2e42f1ddc04e2a42187a960ab4c5515168848e855b152f952399b475dd513e071360a94577ce2013b131b79b07a6cb69572fd681b9eed
SSDEEP

12288:fAvDVy8y/0gJ5eklzgtgVmhm0cFJNMIPyr2p:AVy8y/0gJDlzgnVe8mP

Score

7^/10

discovery evasion

Malware Config

Targets

- Target
  
  bb97c65a7356aebabd0305888eeb8699_JaffaCakes118
- Size
  
  510KB
- MD5
  
  bb97c65a7356aebabd0305888eeb8699
- SHA1
  
  2d966f8c24e22cae7d6c52d7606e191158367e84
- SHA256
  
  c85ac1cd2cd5d00dd21d6a08c88bb2f4fd92ceb31c8a324788200dc956ab46f8
- SHA512
  
  6d9042b1a1c67b601cf2e42f1ddc04e2a42187a960ab4c5515168848e855b152f952399b475dd513e071360a94577ce2013b131b79b07a6cb69572fd681b9eed
- SSDEEP
  
  12288:fAvDVy8y/0gJ5eklzgtgVmhm0cFJNMIPyr2p:AVy8y/0gJDlzgnVe8mP
Score

7^/10

discovery evasion
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasion

behavioral2

discoveryevasion