Overview

overview

9

Static

static

7

1e5070332f...18.exe

windows7-x64

9

1e5070332f...18.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1e5070332f49e9cbae7b485196c1eb6d_JaffaCakes118

  • Size

    3.6MB

  • Sample

    240702-g9knmatgpl

  • MD5

    1e5070332f49e9cbae7b485196c1eb6d

  • SHA1

    56085ad1c178328f0fb7c8b486e1af07ef7e2d52

  • SHA256

    38c12eb3b1bce5606b03cbf68e0eaab0a4211112030a110c196e0a721f30e442

  • SHA512

    d3e4b0d140021e36dd30d4481413217e757082ac10dcdbdb397527d0e8de6ce3469af50021bc2255b4448c57d968912406d23959461cc9d3926e068d8304e7d6

  • SSDEEP

    49152:3pbmRVEQZ99pOz52y2yvzl90ZJAwdGtA2auX0AsUrsqkEAhgzLJqNNIDJ8zVwkVK:3Jm96DYdGRag0A/k7qH0NwWV/xhNu

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      1e5070332f49e9cbae7b485196c1eb6d_JaffaCakes118

    • Size

      3.6MB

    • MD5

      1e5070332f49e9cbae7b485196c1eb6d

    • SHA1

      56085ad1c178328f0fb7c8b486e1af07ef7e2d52

    • SHA256

      38c12eb3b1bce5606b03cbf68e0eaab0a4211112030a110c196e0a721f30e442

    • SHA512

      d3e4b0d140021e36dd30d4481413217e757082ac10dcdbdb397527d0e8de6ce3469af50021bc2255b4448c57d968912406d23959461cc9d3926e068d8304e7d6

    • SSDEEP

      49152:3pbmRVEQZ99pOz52y2yvzl90ZJAwdGtA2auX0AsUrsqkEAhgzLJqNNIDJ8zVwkVK:3Jm96DYdGRag0A/k7qH0NwWV/xhNu

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks