0d4513334bb732e946a351639befd3e4041a4eece56d7accc480c8c674259bcb | Triage

Sharing

General

Target

ce8b733327c4d5479517c47c9d381f9c_JaffaCakes118
Size

309KB
Sample

240906-d12c8sthnc
MD5

ce8b733327c4d5479517c47c9d381f9c
SHA1

37566d7f4f4a04d3fa6b92fdfc239503a5f7b786
SHA256

0d4513334bb732e946a351639befd3e4041a4eece56d7accc480c8c674259bcb
SHA512

f8201f02ad15c3cdee9430c8dcbd450f77c502e0d9126b52d8a094883c840ccd461912f1466d1ddb929a2260e5b03123dac6a2b181a2f51b3b575930eb491673
SSDEEP

6144:2zG8nriOnW/rGgGh4Xw5PfK0OTvQXVU18atNdkfHhylhqHWHMLFqmXPr9:O1DYrr0OcXG8a3uiq2s4c

Score

10^/10

discovery evasion upx

Malware Config

Targets

- Target
  
  ce8b733327c4d5479517c47c9d381f9c_JaffaCakes118
- Size
  
  309KB
- MD5
  
  ce8b733327c4d5479517c47c9d381f9c
- SHA1
  
  37566d7f4f4a04d3fa6b92fdfc239503a5f7b786
- SHA256
  
  0d4513334bb732e946a351639befd3e4041a4eece56d7accc480c8c674259bcb
- SHA512
  
  f8201f02ad15c3cdee9430c8dcbd450f77c502e0d9126b52d8a094883c840ccd461912f1466d1ddb929a2260e5b03123dac6a2b181a2f51b3b575930eb491673
- SSDEEP
  
  6144:2zG8nriOnW/rGgGh4Xw5PfK0OTvQXVU18atNdkfHhylhqHWHMLFqmXPr9:O1DYrr0OcXG8a3uiq2s4c
Score

10^/10

discovery evasion upx
- Modifies firewall policy service
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionupx

behavioral2

discoveryevasionupx