5db5cc276c0731467390e4369345ffe9c349c221df5fc1d58dbdd27e6963ac50 | Triage

Sharing

General

Target

da7e858452919019ee6c61c5c158f28b_JaffaCakes118
Size

529KB
Sample

240911-q8aayatfmn
MD5

da7e858452919019ee6c61c5c158f28b
SHA1

875f2a668abc6c70ec1bba1584b9e4f6e75d8cfc
SHA256

5db5cc276c0731467390e4369345ffe9c349c221df5fc1d58dbdd27e6963ac50
SHA512

d2eb6775bbe9678e92bb87deeba38d1ac5a9a86ee5df8d5a8d50c69a1475bb2a792ff1b6d20142a7812f0f4f158cdc2cf8ab50263c738842f3e80ce5435a6c35
SSDEEP

12288:QyeWT96x+MN2N4Bou8Bw1bFsIPNHqC5xlA0l:QyeAEwN4BuYFsI1KyV

Score

10^/10

discovery evasion execution trojan

Malware Config

Targets

- Target
  
  da7e858452919019ee6c61c5c158f28b_JaffaCakes118
- Size
  
  529KB
- MD5
  
  da7e858452919019ee6c61c5c158f28b
- SHA1
  
  875f2a668abc6c70ec1bba1584b9e4f6e75d8cfc
- SHA256
  
  5db5cc276c0731467390e4369345ffe9c349c221df5fc1d58dbdd27e6963ac50
- SHA512
  
  d2eb6775bbe9678e92bb87deeba38d1ac5a9a86ee5df8d5a8d50c69a1475bb2a792ff1b6d20142a7812f0f4f158cdc2cf8ab50263c738842f3e80ce5435a6c35
- SSDEEP
  
  12288:QyeWT96x+MN2N4Bou8Bw1bFsIPNHqC5xlA0l:QyeAEwN4BuYFsI1KyV
Score

10^/10

discovery evasion execution trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Stops running service(s)
  evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

discoveryevasionexecutiontrojan

behavioral2

discoveryevasionexecutiontrojan