ceb07c133c0781b1bb5bbbfdaa76ed56f3f38e7b05693ed82a21726fa0e8d8af | Triage

Sharing

Copy URL Twitter E-mail

General

Target

44c5cbd4aca6f126da29f492fad26595_JaffaCakes118
Size

346KB
Sample

241014-3sy1kswfkk
MD5

44c5cbd4aca6f126da29f492fad26595
SHA1

2a91a75bb731770f3480f2948dc03ea336946a76
SHA256

ceb07c133c0781b1bb5bbbfdaa76ed56f3f38e7b05693ed82a21726fa0e8d8af
SHA512

8e307a1578beecccd405309303e1b94d7621e44a8ebd8ee7cc760e84bd6a5f0645df881d9f99ae02631ee5b38b007726faa0653e053889821bd0b00ef1273b5a
SSDEEP

6144:3ytEtAh3xoI2OpOApn+8fZqZggUoSKYG6w4WWwXV8wM6jmVFpNhmNMxJO4W4oljp:3yqtAhhoI1zpZfZ4ggUoSKYG6w4WWwXH

Score

10^/10

discovery evasion

Malware Config

Targets

- Target
  
  44c5cbd4aca6f126da29f492fad26595_JaffaCakes118
- Size
  
  346KB
- MD5
  
  44c5cbd4aca6f126da29f492fad26595
- SHA1
  
  2a91a75bb731770f3480f2948dc03ea336946a76
- SHA256
  
  ceb07c133c0781b1bb5bbbfdaa76ed56f3f38e7b05693ed82a21726fa0e8d8af
- SHA512
  
  8e307a1578beecccd405309303e1b94d7621e44a8ebd8ee7cc760e84bd6a5f0645df881d9f99ae02631ee5b38b007726faa0653e053889821bd0b00ef1273b5a
- SSDEEP
  
  6144:3ytEtAh3xoI2OpOApn+8fZqZggUoSKYG6w4WWwXV8wM6jmVFpNhmNMxJO4W4oljp:3yqtAhhoI1zpZfZ4ggUoSKYG6w4WWwXH
Score

10^/10

discovery evasion
- Modifies security service
  evasion
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasion

behavioral2

discoveryevasion