Overview

overview

9

Static

static

3

4347cf92ef...18.dll

windows7-x64

9

4347cf92ef...18.dll

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    4347cf92efc622884f479f7fac421d3f_JaffaCakes118

  • Size

    732KB

  • Sample

    241014-vqgphswdqh

  • MD5

    4347cf92efc622884f479f7fac421d3f

  • SHA1

    4abc4cc25d0b51c180de8049a8eb421d8c92efb9

  • SHA256

    b1a105887048eacbe0c3b322b11aa58413997007538fc63ce67e27b9f7fd5557

  • SHA512

    d6cfb7d744ced8a2baa92981a997e95b9d23b0a5d801527873f33fbca796b562164ec4459235dccfd20e0f7c265f445cb70f7661a4b459fe9ff4604d12f7721a

  • SSDEEP

    12288:dSJWL+tfdTB4zb89B3JASb9+vAzwBKBfuureDsSYzVNyCBmCD0vZNEgqrkCcvEw:dSJWAfXosb9+ocBKcswsSQVNjBExzSkO

Score
9/10
discoveryevasion

Malware Config

Targets

    • Target

      4347cf92efc622884f479f7fac421d3f_JaffaCakes118

    • Size

      732KB

    • MD5

      4347cf92efc622884f479f7fac421d3f

    • SHA1

      4abc4cc25d0b51c180de8049a8eb421d8c92efb9

    • SHA256

      b1a105887048eacbe0c3b322b11aa58413997007538fc63ce67e27b9f7fd5557

    • SHA512

      d6cfb7d744ced8a2baa92981a997e95b9d23b0a5d801527873f33fbca796b562164ec4459235dccfd20e0f7c265f445cb70f7661a4b459fe9ff4604d12f7721a

    • SSDEEP

      12288:dSJWL+tfdTB4zb89B3JASb9+vAzwBKBfuureDsSYzVNyCBmCD0vZNEgqrkCcvEw:dSJWAfXosb9+ocBKcswsSQVNjBExzSkO

    Score
    9/10
    discoveryevasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks