acc43dfae6dc85529a629e58c67e819ba20fd36d1c08a3683bc5256ef1c6e0fc | Triage

Sharing

General

Target

e1b291f81f693f2a4f0c2292128f603c_JaffaCakes118
Size

2.7MB
Sample

240915-e1wy7awajd
MD5

e1b291f81f693f2a4f0c2292128f603c
SHA1

8b1eca2cf9390649a836d1f61780c0cd36d374a4
SHA256

acc43dfae6dc85529a629e58c67e819ba20fd36d1c08a3683bc5256ef1c6e0fc
SHA512

5a3fdb7ff6144c4108c65713c6a3479c19a6eb7d5eb3de6c633a46d8f8e9104085b0a1ea8a60667e5c56c411c84c7a71190e181d230834aa47f57a9369738ad5
SSDEEP

49152:TsYWjwx6AmC3Xa5gbe0g5nS8o1t6amA3EJRSGrVQswSY7a:T3V6AbXa5zFnSZVmA0DSGRQsP

Score

7^/10

discovery evasion trojan

Malware Config

Targets

- Target
  
  e1b291f81f693f2a4f0c2292128f603c_JaffaCakes118
- Size
  
  2.7MB
- MD5
  
  e1b291f81f693f2a4f0c2292128f603c
- SHA1
  
  8b1eca2cf9390649a836d1f61780c0cd36d374a4
- SHA256
  
  acc43dfae6dc85529a629e58c67e819ba20fd36d1c08a3683bc5256ef1c6e0fc
- SHA512
  
  5a3fdb7ff6144c4108c65713c6a3479c19a6eb7d5eb3de6c633a46d8f8e9104085b0a1ea8a60667e5c56c411c84c7a71190e181d230834aa47f57a9369738ad5
- SSDEEP
  
  49152:TsYWjwx6AmC3Xa5gbe0g5nS8o1t6amA3EJRSGrVQswSY7a:T3V6AbXa5zFnSZVmA0DSGRQsP
Score

7^/10

discovery evasion trojan
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasiontrojan

behavioral2

discoveryevasiontrojan