0550366ff6410ce78e770105b791784ab1998aae4b562fb01a9e9d0c7c031f31 | Triage

Sharing

General

Target

ead2b0e8eb2f2566090e66e1a2c4698c_JaffaCakes118
Size

673KB
Sample

240919-hzvlhsxakl
MD5

ead2b0e8eb2f2566090e66e1a2c4698c
SHA1

a25a21336f2e8c935e6a706af0e71738de450b21
SHA256

0550366ff6410ce78e770105b791784ab1998aae4b562fb01a9e9d0c7c031f31
SHA512

948afd35a447aeab20c2fb9df939da18a4fd6690e31b4c1504e9c539c7c20ead89ae4c3f4cd0f7cdd728598677dad8c0699fed276a1e442578159f1273f567e2
SSDEEP

12288:q5v8XvqRrYvhPi7cTqoRKHgGYcveMTv7AqeLDDuu9YMVFca6L:Cv8XCH7uqHgGY4e0QDD9YMV2a6L

Score

9^/10

discovery evasion

Malware Config

Targets

- Target
  
  ead2b0e8eb2f2566090e66e1a2c4698c_JaffaCakes118
- Size
  
  673KB
- MD5
  
  ead2b0e8eb2f2566090e66e1a2c4698c
- SHA1
  
  a25a21336f2e8c935e6a706af0e71738de450b21
- SHA256
  
  0550366ff6410ce78e770105b791784ab1998aae4b562fb01a9e9d0c7c031f31
- SHA512
  
  948afd35a447aeab20c2fb9df939da18a4fd6690e31b4c1504e9c539c7c20ead89ae4c3f4cd0f7cdd728598677dad8c0699fed276a1e442578159f1273f567e2
- SSDEEP
  
  12288:q5v8XvqRrYvhPi7cTqoRKHgGYcveMTv7AqeLDDuu9YMVFca6L:Cv8XCH7uqHgGY4e0QDD9YMV2a6L
Score

9^/10

discovery evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoveryevasion