051b81781a6029d6bbd475ce6f906528d88e1be2805e0b517e54e1a28f52800e | Triage

Sharing

General

Target

43a2f81975b01b083320924fcf22dfd8_JaffaCakes118
Size

516KB
Sample

240514-3vdsesef4y
MD5

43a2f81975b01b083320924fcf22dfd8
SHA1

c9e6d88fcd2d143df226d60db08d4b9422598e1f
SHA256

051b81781a6029d6bbd475ce6f906528d88e1be2805e0b517e54e1a28f52800e
SHA512

9516868db313e318605de9a6b0843c39575ece5453524cc2ff19f1f71c26144f6b1e220efcaa2dcda55819213c1592726889d0dc3571d2f03213721ff1ea9d2a
SSDEEP

6144:/Kw9ZuL+7TBufhHztxTBIp2ZrPs+JiifYPeyy8JAt3kgURi34wgC1:/Kw9ZuL+7TQfhhcGTs+lYWyp+tcyNZ

Score

9^/10

evasion

Malware Config

Targets

- Target
  
  43a2f81975b01b083320924fcf22dfd8_JaffaCakes118
- Size
  
  516KB
- MD5
  
  43a2f81975b01b083320924fcf22dfd8
- SHA1
  
  c9e6d88fcd2d143df226d60db08d4b9422598e1f
- SHA256
  
  051b81781a6029d6bbd475ce6f906528d88e1be2805e0b517e54e1a28f52800e
- SHA512
  
  9516868db313e318605de9a6b0843c39575ece5453524cc2ff19f1f71c26144f6b1e220efcaa2dcda55819213c1592726889d0dc3571d2f03213721ff1ea9d2a
- SSDEEP
  
  6144:/Kw9ZuL+7TBufhHztxTBIp2ZrPs+JiifYPeyy8JAt3kgURi34wgC1:/Kw9ZuL+7TQfhhcGTs+lYWyp+tcyNZ
Score

9^/10

evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2