Overview

overview

7

Static

static

7

f5c3fe1b14...18.exe

windows7-x64

7

f5c3fe1b14...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f5c3fe1b148576448a7803ceebf46b1d_JaffaCakes118

  • Size

    949KB

  • Sample

    240925-l47y7asepe

  • MD5

    f5c3fe1b148576448a7803ceebf46b1d

  • SHA1

    084a51628479a08bcd39c4493308d11b26b6b4cd

  • SHA256

    ab62a55eecbceb9b2db7a105bc13368e93dbd2ca5c1578828640e8fb21ff53f0

  • SHA512

    9df2bc8e51d6829ce4e0544fb6a326309c9fa085d96b0159c5dafdfa09b525a28814c4d96b108a2ea5c4fe0dcd2f430e2953612298a62174f9aeb984ea2a64aa

  • SSDEEP

    24576:1f6PFdqzs7h4YPuMvGYwyH26/ATQ94vxqHTJ5Px+0WA:eLqzykMvbwyHDYTQOqN1gb

Score
7/10
discoveryevasionpersistencethemida

Malware Config

Targets

    • Target

      f5c3fe1b148576448a7803ceebf46b1d_JaffaCakes118

    • Size

      949KB

    • MD5

      f5c3fe1b148576448a7803ceebf46b1d

    • SHA1

      084a51628479a08bcd39c4493308d11b26b6b4cd

    • SHA256

      ab62a55eecbceb9b2db7a105bc13368e93dbd2ca5c1578828640e8fb21ff53f0

    • SHA512

      9df2bc8e51d6829ce4e0544fb6a326309c9fa085d96b0159c5dafdfa09b525a28814c4d96b108a2ea5c4fe0dcd2f430e2953612298a62174f9aeb984ea2a64aa

    • SSDEEP

      24576:1f6PFdqzs7h4YPuMvGYwyH26/ATQ94vxqHTJ5Px+0WA:eLqzykMvbwyHDYTQOqN1gb

    Score
    7/10
    discoveryevasionpersistencethemida

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks