66e419e7d721aa8435a7cd4133fa0c4304f374e4bc8fcd376e4a89908a306b38 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bda7adcaf1a3cecc34311d382257d3f1_JaffaCakes118
Size

767KB
Sample

240824-atv14axfpp
MD5

bda7adcaf1a3cecc34311d382257d3f1
SHA1

260e62ef10ea184cbab3085f336f653401e1bcd1
SHA256

66e419e7d721aa8435a7cd4133fa0c4304f374e4bc8fcd376e4a89908a306b38
SHA512

372f747e929ec69b30ebbffa08c1c469d0a04b5f4bdf6227ab55c3c8c0187ccb0061ab6a63c7656a2660ecbec96b57159ea985bbbf534be72cbf0209ff869513
SSDEEP

12288:yJIh9+2OvJAbOJhx8FF0OOUyuqkySinmE7DWhI08GGaSYRfX7Q5fJi2:n3+dvuy2IZWCnCQhJi2

Score

9^/10

discovery evasion

Malware Config

Targets

- Target
  
  bda7adcaf1a3cecc34311d382257d3f1_JaffaCakes118
- Size
  
  767KB
- MD5
  
  bda7adcaf1a3cecc34311d382257d3f1
- SHA1
  
  260e62ef10ea184cbab3085f336f653401e1bcd1
- SHA256
  
  66e419e7d721aa8435a7cd4133fa0c4304f374e4bc8fcd376e4a89908a306b38
- SHA512
  
  372f747e929ec69b30ebbffa08c1c469d0a04b5f4bdf6227ab55c3c8c0187ccb0061ab6a63c7656a2660ecbec96b57159ea985bbbf534be72cbf0209ff869513
- SSDEEP
  
  12288:yJIh9+2OvJAbOJhx8FF0OOUyuqkySinmE7DWhI08GGaSYRfX7Q5fJi2:n3+dvuy2IZWCnCQhJi2
Score

9^/10

discovery evasion
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Enumerates VirtualBox registry keys
  evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Software Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasion

behavioral2