19a19bc0d80208e9f627d123208d225e8b7c1db37d2dc5559e46c8a130920ca0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b9f7e7bb29cc01b00d99ae1bbd100902_JaffaCakes118
Size

60KB
Sample

240823-cpceaszfkh
MD5

b9f7e7bb29cc01b00d99ae1bbd100902
SHA1

c548dd900e27d1864fe11f01b0023eaca655d2d6
SHA256

19a19bc0d80208e9f627d123208d225e8b7c1db37d2dc5559e46c8a130920ca0
SHA512

93171f3e6df3572c578c9b97758feb8315eea517d8893ec4c37c087bd0640b202af8088fd00c9d75af8ed7af11e50e2c4b3eea6ad0555397e2c970fbbe219a6b
SSDEEP

768:2yu3jDsGtGHMCuDcg4yHIN+e/KYIEnIOX4fQGW8B0eaVAy+0ZEqhlNC+NPKwV9OC:JhbuDXHI1iZExj8BLy/ZDhlw+sYQ+B

Score

7^/10

defense_evasion discovery evasion trojan

Malware Config

Targets

- Target
  
  b9f7e7bb29cc01b00d99ae1bbd100902_JaffaCakes118
- Size
  
  60KB
- MD5
  
  b9f7e7bb29cc01b00d99ae1bbd100902
- SHA1
  
  c548dd900e27d1864fe11f01b0023eaca655d2d6
- SHA256
  
  19a19bc0d80208e9f627d123208d225e8b7c1db37d2dc5559e46c8a130920ca0
- SHA512
  
  93171f3e6df3572c578c9b97758feb8315eea517d8893ec4c37c087bd0640b202af8088fd00c9d75af8ed7af11e50e2c4b3eea6ad0555397e2c970fbbe219a6b
- SSDEEP
  
  768:2yu3jDsGtGHMCuDcg4yHIN+e/KYIEnIOX4fQGW8B0eaVAy+0ZEqhlNC+NPKwV9OC:JhbuDXHI1iZExj8BLy/ZDhlw+sYQ+B
Score

7^/10

defense_evasion discovery evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
  evasion trojan
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryevasiontrojan

behavioral2

defense_evasiondiscoveryevasiontrojan