622d580dc26dc81d0d9a4c0a396db513737e7237d166e2b6c1d9a66fa71821e9 | Triage

Sharing

General

Target

93af744fa95d6ead692424cbbab3e8e5_JaffaCakes118
Size

2.0MB
Sample

240813-szr6ha1gqg
MD5

93af744fa95d6ead692424cbbab3e8e5
SHA1

286b3ddd319bd8d5e49db6675ff6dada73d86930
SHA256

622d580dc26dc81d0d9a4c0a396db513737e7237d166e2b6c1d9a66fa71821e9
SHA512

d4097194ffe68f31412756551c0f154f15ad6fdaa3e485a6b4815eb64f546bc0884541129f64ed5cb46e6bdefb724749c065f3bb7622799611adf111d9ebfdfc
SSDEEP

49152:r8cUfZsF6GWhsesortO2FAZ8mlQuR7Djfan3zIEUttrx7H2:r8XxxGWhDjWDQ+QoDx2

Score

7^/10

defense_evasion discovery

Malware Config

Targets

- Target
  
  93af744fa95d6ead692424cbbab3e8e5_JaffaCakes118
- Size
  
  2.0MB
- MD5
  
  93af744fa95d6ead692424cbbab3e8e5
- SHA1
  
  286b3ddd319bd8d5e49db6675ff6dada73d86930
- SHA256
  
  622d580dc26dc81d0d9a4c0a396db513737e7237d166e2b6c1d9a66fa71821e9
- SHA512
  
  d4097194ffe68f31412756551c0f154f15ad6fdaa3e485a6b4815eb64f546bc0884541129f64ed5cb46e6bdefb724749c065f3bb7622799611adf111d9ebfdfc
- SSDEEP
  
  49152:r8cUfZsF6GWhsesortO2FAZ8mlQuR7Djfan3zIEUttrx7H2:r8XxxGWhDjWDQ+QoDx2
Score

7^/10

discovery defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

File Deletion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

defense_evasiondiscovery