13d49bb1f6255b3e593b4ba0d95bd5c9f7388c82cd3144677ea1519b5fae8b57 | Triage

Sharing

General

Target

63f7573da8d8821c6d15ca5a89521baa_JaffaCakes118
Size

512KB
Sample

240521-tzt6jabg26
MD5

63f7573da8d8821c6d15ca5a89521baa
SHA1

1393cab28da9c17b22f65030ca1cf75b6e668305
SHA256

13d49bb1f6255b3e593b4ba0d95bd5c9f7388c82cd3144677ea1519b5fae8b57
SHA512

27c7a26a597dd230b523679e88193479ff1e12c34e23a1db0e7b33226e0028d7496c3ea5aa1d53d3e0208cb4c3312d9478694019b7b7bf04aa5427ef654bef20
SSDEEP

12288:0+h9St2Ma70zIIc91Dwws4zruXic2O/3E4D:0+h9OY70z+warul3E4D

Score

9^/10

evasion

Malware Config

Targets

- Target
  
  63f7573da8d8821c6d15ca5a89521baa_JaffaCakes118
- Size
  
  512KB
- MD5
  
  63f7573da8d8821c6d15ca5a89521baa
- SHA1
  
  1393cab28da9c17b22f65030ca1cf75b6e668305
- SHA256
  
  13d49bb1f6255b3e593b4ba0d95bd5c9f7388c82cd3144677ea1519b5fae8b57
- SHA512
  
  27c7a26a597dd230b523679e88193479ff1e12c34e23a1db0e7b33226e0028d7496c3ea5aa1d53d3e0208cb4c3312d9478694019b7b7bf04aa5427ef654bef20
- SSDEEP
  
  12288:0+h9St2Ma70zIIc91Dwws4zruXic2O/3E4D:0+h9OY70z+warul3E4D
Score

9^/10

evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Subvert Trust Controls

Install Root Certificate

Modify Registry

Credential Access

Discovery

Query Registry

Virtualization/Sandbox Evasion

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2