245aa4b94cf34f24aaea41febd20d0e61eedd98b133be7736274beaee215e72b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f040b74cfee8b47ba66000013e9499cd_JaffaCakes118
Size

624KB
Sample

240921-vkrbrstdml
MD5

f040b74cfee8b47ba66000013e9499cd
SHA1

e2d5dac9dc99dab22cbb0d025325824f869d94bf
SHA256

245aa4b94cf34f24aaea41febd20d0e61eedd98b133be7736274beaee215e72b
SHA512

f99493635b08c95e6ea0908a502028e16d62e61acea4d7dc5e8a5f932d9b27c59b6ea9b0657d4fae22b95fcee315f0ba66b7ec77093029202b01f4646bbff0cd
SSDEEP

12288:6MdUFRTEJcwQQJFs0mib/Sp2UC+Am8hnbI3fnW1L6Jxs2zi9oXN:1UFS6HibQA/NbUfnW1W3sQi9oXN

Score

9^/10

discovery evasion

Malware Config

Targets

- Target
  
  f040b74cfee8b47ba66000013e9499cd_JaffaCakes118
- Size
  
  624KB
- MD5
  
  f040b74cfee8b47ba66000013e9499cd
- SHA1
  
  e2d5dac9dc99dab22cbb0d025325824f869d94bf
- SHA256
  
  245aa4b94cf34f24aaea41febd20d0e61eedd98b133be7736274beaee215e72b
- SHA512
  
  f99493635b08c95e6ea0908a502028e16d62e61acea4d7dc5e8a5f932d9b27c59b6ea9b0657d4fae22b95fcee315f0ba66b7ec77093029202b01f4646bbff0cd
- SSDEEP
  
  12288:6MdUFRTEJcwQQJFs0mib/Sp2UC+Am8hnbI3fnW1L6Jxs2zi9oXN:1UFS6HibQA/NbUfnW1W3sQi9oXN
Score

9^/10

discovery evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoveryevasion