eba516e043bcb59183b3d3bf48e75c3b7e158f1446b219ca1b63ef31b769b7ff | Triage

Sharing

General

Target

abe5ba6f171ff8f2d5edf40957b52e3d_JaffaCakes118
Size

944KB
Sample

240614-211cyazcqd
MD5

abe5ba6f171ff8f2d5edf40957b52e3d
SHA1

dedec4d9bd3425564a6a3d1dd0055b478ffca86b
SHA256

eba516e043bcb59183b3d3bf48e75c3b7e158f1446b219ca1b63ef31b769b7ff
SHA512

afbc66634b0c376d880746419f16ed27235906d986b44ff6a3a6e1eea884dbe350ae4316e98bb61e0d7ba293e16bc3b95ac5562524c7ebf9dde3f62e4422d7a6
SSDEEP

24576:6SsAZkp5IRBGLpGLMMMHMMMvMMZMMMKzbKXOMMHMMMvMMZMMMKzbKX7GLMMMHMMF:lsAZ+I2MMHMMMvMMZMMMFOMMHMMMvMMk

Score

7^/10

Malware Config

Targets

- Target
  
  abe5ba6f171ff8f2d5edf40957b52e3d_JaffaCakes118
- Size
  
  944KB
- MD5
  
  abe5ba6f171ff8f2d5edf40957b52e3d
- SHA1
  
  dedec4d9bd3425564a6a3d1dd0055b478ffca86b
- SHA256
  
  eba516e043bcb59183b3d3bf48e75c3b7e158f1446b219ca1b63ef31b769b7ff
- SHA512
  
  afbc66634b0c376d880746419f16ed27235906d986b44ff6a3a6e1eea884dbe350ae4316e98bb61e0d7ba293e16bc3b95ac5562524c7ebf9dde3f62e4422d7a6
- SSDEEP
  
  24576:6SsAZkp5IRBGLpGLMMMHMMMvMMZMMMKzbKXOMMHMMMvMMZMMMKzbKX7GLMMMHMMF:lsAZ+I2MMHMMMvMMZMMMFOMMHMMMvMMk
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2