241279eee49bd9c96054c7ca0597a00b0b03a3a0c692ea8ac4a2329ea3d37555 | Triage

Sharing

General

Target

d59ceba872136ea7a1d15c6404adc80e_JaffaCakes118
Size

664KB
Sample

240909-efse9szhlp
MD5

d59ceba872136ea7a1d15c6404adc80e
SHA1

46a7e87f5ecdef40a06cd7ebb35fa0fd0922b716
SHA256

241279eee49bd9c96054c7ca0597a00b0b03a3a0c692ea8ac4a2329ea3d37555
SHA512

fe695f494936d5f971c7169f0ec5d080b23c22adc70996fdba7b1e232d6a3f52a2d9038a2df5755caecc078c8d116643d51c1afa11ab4d5360ba10c8713b8b6b
SSDEEP

12288:YTf5y14kK0RuPZf1HW9Yui4IRYK2VO0X9bDIFVhB0ZJE+Xhs16A:Wf5yCkqZf129YupJ9O0X9b0FVDqEcC1L

Score

9^/10

discovery evasion

Malware Config

Targets

- Target
  
  d59ceba872136ea7a1d15c6404adc80e_JaffaCakes118
- Size
  
  664KB
- MD5
  
  d59ceba872136ea7a1d15c6404adc80e
- SHA1
  
  46a7e87f5ecdef40a06cd7ebb35fa0fd0922b716
- SHA256
  
  241279eee49bd9c96054c7ca0597a00b0b03a3a0c692ea8ac4a2329ea3d37555
- SHA512
  
  fe695f494936d5f971c7169f0ec5d080b23c22adc70996fdba7b1e232d6a3f52a2d9038a2df5755caecc078c8d116643d51c1afa11ab4d5360ba10c8713b8b6b
- SSDEEP
  
  12288:YTf5y14kK0RuPZf1HW9Yui4IRYK2VO0X9bDIFVhB0ZJE+Xhs16A:Wf5yCkqZf129YupJ9O0X9b0FVDqEcC1L
Score

9^/10

discovery evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasion

behavioral2

discoveryevasion