16d716ed6033e9010fb7253158f6e27ae5b51ed168b0abef75454d33b64812e1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

efaeb43f5321df9cb5c502d8b78a0691_JaffaCakes118
Size

680KB
Sample

240921-nf56sszdnk
MD5

efaeb43f5321df9cb5c502d8b78a0691
SHA1

ee3e0abed9ceff1bbb1ff975600b311f66bd5d49
SHA256

16d716ed6033e9010fb7253158f6e27ae5b51ed168b0abef75454d33b64812e1
SHA512

dda8da0ebaea2dafd7d96f7bb1a4a8a5280fa31c733e4b73a6c20d6c26f90ec3bd99f606d4844c2fb2bb2fec51b57240ca732bc896bcb557452703bf31839da7
SSDEEP

12288:C82isfaTcM8/kNcHKp3IVHWcjSf4P/cJL5a/5WdU6AmR+6mC:32isfdMqTPwcjSf4P/cJL5a/5FmR+6mC

Score

9^/10

discovery evasion

Malware Config

Targets

- Target
  
  efaeb43f5321df9cb5c502d8b78a0691_JaffaCakes118
- Size
  
  680KB
- MD5
  
  efaeb43f5321df9cb5c502d8b78a0691
- SHA1
  
  ee3e0abed9ceff1bbb1ff975600b311f66bd5d49
- SHA256
  
  16d716ed6033e9010fb7253158f6e27ae5b51ed168b0abef75454d33b64812e1
- SHA512
  
  dda8da0ebaea2dafd7d96f7bb1a4a8a5280fa31c733e4b73a6c20d6c26f90ec3bd99f606d4844c2fb2bb2fec51b57240ca732bc896bcb557452703bf31839da7
- SSDEEP
  
  12288:C82isfaTcM8/kNcHKp3IVHWcjSf4P/cJL5a/5WdU6AmR+6mC:32isfdMqTPwcjSf4P/cJL5a/5FmR+6mC
Score

9^/10

discovery evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoveryevasion