13b3d40e2be3a8c7ea04cec1ed8a09461adce1b10b7bb8d4b63e0a719eddbdc1 | Triage

Sharing

General

Target

d3fbb72c353cbae4007eb0fec6d297cc_JaffaCakes118
Size

664KB
Sample

240908-kvdhjswhpk
MD5

d3fbb72c353cbae4007eb0fec6d297cc
SHA1

e37a58505345ec068814a772c301837b6b42e02f
SHA256

13b3d40e2be3a8c7ea04cec1ed8a09461adce1b10b7bb8d4b63e0a719eddbdc1
SHA512

881a1f9224d8217d8bc645a581c76be027f2f0a2a2caf9cd9a3d155cd593f9b0ce4e6ba2954070fcac7ed4ea1c9f489014af2768e04d3fac9412bef6ca745fe0
SSDEEP

12288:YTf5y14kK0RuPZf1HW9Yui4IRYK2VO0X9bDIFVhB0ZJE+Xhs16T6:Wf5yCkqZf129YupJ9O0X9b0FVDqEcC1J

Score

9^/10

discovery evasion

Malware Config

Targets

- Target
  
  d3fbb72c353cbae4007eb0fec6d297cc_JaffaCakes118
- Size
  
  664KB
- MD5
  
  d3fbb72c353cbae4007eb0fec6d297cc
- SHA1
  
  e37a58505345ec068814a772c301837b6b42e02f
- SHA256
  
  13b3d40e2be3a8c7ea04cec1ed8a09461adce1b10b7bb8d4b63e0a719eddbdc1
- SHA512
  
  881a1f9224d8217d8bc645a581c76be027f2f0a2a2caf9cd9a3d155cd593f9b0ce4e6ba2954070fcac7ed4ea1c9f489014af2768e04d3fac9412bef6ca745fe0
- SSDEEP
  
  12288:YTf5y14kK0RuPZf1HW9Yui4IRYK2VO0X9bDIFVhB0ZJE+Xhs16T6:Wf5yCkqZf129YupJ9O0X9b0FVDqEcC1J
Score

9^/10

discovery evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoveryevasion