c2e08878b9e2df906c2032b5609cb40b01e14fc6a4e8973cab0553d71dcaf1fb | Triage

Sharing

General

Target

e9f7be53f96c90fecbf83c04a1814ea7_JaffaCakes118
Size

88KB
Sample

240918-zwketatana
MD5

e9f7be53f96c90fecbf83c04a1814ea7
SHA1

50539cf4998804a27acfda224d8e6c6273ff06f5
SHA256

c2e08878b9e2df906c2032b5609cb40b01e14fc6a4e8973cab0553d71dcaf1fb
SHA512

b4127dda0719e609550946a77b15e9223f222c81995215b0581acec6dbf086984644af25288b3d84d432da0d734764ea353d7b5cdf643d2985b73349edf53a09
SSDEEP

1536:ObwRc4N1gQOwm4B4PJh6VB9o9lcY/3t2eVgxWz5FsuWBVlTik9bu382iF60+:gwR5g46PJh+jgSO5gxWzzsuumIuM2E+

Score

8^/10

discovery evasion

Malware Config

Targets

- Target
  
  e9f7be53f96c90fecbf83c04a1814ea7_JaffaCakes118
- Size
  
  88KB
- MD5
  
  e9f7be53f96c90fecbf83c04a1814ea7
- SHA1
  
  50539cf4998804a27acfda224d8e6c6273ff06f5
- SHA256
  
  c2e08878b9e2df906c2032b5609cb40b01e14fc6a4e8973cab0553d71dcaf1fb
- SHA512
  
  b4127dda0719e609550946a77b15e9223f222c81995215b0581acec6dbf086984644af25288b3d84d432da0d734764ea353d7b5cdf643d2985b73349edf53a09
- SSDEEP
  
  1536:ObwRc4N1gQOwm4B4PJh6VB9o9lcY/3t2eVgxWz5FsuWBVlTik9bu382iF60+:gwR5g46PJh+jgSO5gxWzzsuumIuM2E+
Score

8^/10

discovery evasion
- Drops file in Drivers directory
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasion

behavioral2

discoveryevasion