ef835ee3813bdcd035d983800ccfb12571b35423581d3941e0b0f562378930b1 | Triage

Sharing

General

Target

edd02d993d27c3313fab0b8d653ed71e_JaffaCakes118
Size

525KB
Sample

240920-r2vtqssbrr
MD5

edd02d993d27c3313fab0b8d653ed71e
SHA1

fddd700ec6f2bc1d3812d0f3f2b8f9100abb2388
SHA256

ef835ee3813bdcd035d983800ccfb12571b35423581d3941e0b0f562378930b1
SHA512

33b0d0e0b706d56ad8ea45e23cca2801d89814190302127e48ebf4a91025ac1f160fa078e001118631e81a42f4e1200ed12c02e0cf12a3fbff82fb054e35703f
SSDEEP

12288:TAl76x5mSJzuCzUD3wyzlUP3meoeTbeAEjK:TAIVuCzU0yzuseTSP

Score

10^/10

discovery evasion

Malware Config

Targets

- Target
  
  edd02d993d27c3313fab0b8d653ed71e_JaffaCakes118
- Size
  
  525KB
- MD5
  
  edd02d993d27c3313fab0b8d653ed71e
- SHA1
  
  fddd700ec6f2bc1d3812d0f3f2b8f9100abb2388
- SHA256
  
  ef835ee3813bdcd035d983800ccfb12571b35423581d3941e0b0f562378930b1
- SHA512
  
  33b0d0e0b706d56ad8ea45e23cca2801d89814190302127e48ebf4a91025ac1f160fa078e001118631e81a42f4e1200ed12c02e0cf12a3fbff82fb054e35703f
- SSDEEP
  
  12288:TAl76x5mSJzuCzUD3wyzlUP3meoeTbeAEjK:TAIVuCzU0yzuseTSP
Score

10^/10

discovery evasion
- Modifies firewall policy service
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Uses the VBS compiler for execution
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Scripting

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasion

behavioral2

discoveryevasion