a53f12411a706313d31820f4175c7ecd18c226eac90dcb052ee72932e1b6a880 | Triage

Sharing

General

Target

dbe5b02bcc3f7238efa012861d6e6ed9_JaffaCakes118
Size

1.3MB
Sample

240912-f7s2jstcmj
MD5

dbe5b02bcc3f7238efa012861d6e6ed9
SHA1

c7882c9e7132539cd1287a32ed75f43f453bf68d
SHA256

a53f12411a706313d31820f4175c7ecd18c226eac90dcb052ee72932e1b6a880
SHA512

5ebc20be6854f471f09daf7cf649f7082328fae0817f52d63dc6c5ddd7cabf6019f76761c235d01942642254fd3c4e1f7a165ebc36c65a30f40b5e123f98ae5f
SSDEEP

24576:4VpuZhaxt/BG6ZptcHm015CvA6BJlEcdLIdYFd:4VpuZUddjted18v5PUCn

Score

9^/10

discovery evasion trojan

Malware Config

Targets

- Target
  
  dbe5b02bcc3f7238efa012861d6e6ed9_JaffaCakes118
- Size
  
  1.3MB
- MD5
  
  dbe5b02bcc3f7238efa012861d6e6ed9
- SHA1
  
  c7882c9e7132539cd1287a32ed75f43f453bf68d
- SHA256
  
  a53f12411a706313d31820f4175c7ecd18c226eac90dcb052ee72932e1b6a880
- SHA512
  
  5ebc20be6854f471f09daf7cf649f7082328fae0817f52d63dc6c5ddd7cabf6019f76761c235d01942642254fd3c4e1f7a165ebc36c65a30f40b5e123f98ae5f
- SSDEEP
  
  24576:4VpuZhaxt/BG6ZptcHm015CvA6BJlEcdLIdYFd:4VpuZUddjted18v5PUCn
Score

9^/10

discovery evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasiontrojan

behavioral2

discoveryevasion