f3edd288c8218d346732f53ffaf823f63973a9580cd0acbb8c403db9fa7d3122 | Triage

Sharing

General

Target

4641b4db4d41bb87f8bb627662773c19_JaffaCakes118
Size

304KB
Sample

241015-g6nk4szbkb
MD5

4641b4db4d41bb87f8bb627662773c19
SHA1

51540e595b33662989dc384fa4f9fc5582204b53
SHA256

f3edd288c8218d346732f53ffaf823f63973a9580cd0acbb8c403db9fa7d3122
SHA512

1e878272d0143fa3fb83aac737b558bcd218f78baf1b73149fa2d7f2aa1bd5f2216d73ab998d9d35c68046be295033d84a7cd022d57b8e7dabda3a0b7908e46c
SSDEEP

6144:3bx/HePo/7PDoLsz6uEIEC3SIozm+U7X5x72LMFg08+LQv:3bRWoTPD6E6uEIf3Oan27//v

Score

8^/10

defense_evasion discovery

Malware Config

Targets

- Target
  
  4641b4db4d41bb87f8bb627662773c19_JaffaCakes118
- Size
  
  304KB
- MD5
  
  4641b4db4d41bb87f8bb627662773c19
- SHA1
  
  51540e595b33662989dc384fa4f9fc5582204b53
- SHA256
  
  f3edd288c8218d346732f53ffaf823f63973a9580cd0acbb8c403db9fa7d3122
- SHA512
  
  1e878272d0143fa3fb83aac737b558bcd218f78baf1b73149fa2d7f2aa1bd5f2216d73ab998d9d35c68046be295033d84a7cd022d57b8e7dabda3a0b7908e46c
- SSDEEP
  
  6144:3bx/HePo/7PDoLsz6uEIEC3SIozm+U7X5x72LMFg08+LQv:3bRWoTPD6E6uEIf3Oan27//v
Score

8^/10

discovery defense_evasion
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

File Deletion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

defense_evasiondiscovery