662c718a42dd20d117227761000cfc125d6060842014faa1fb96371ab67b52bd | Triage

Sharing

General

Target

6fe5c1089930e6c2ae5a6fd111cc1258_JaffaCakes118
Size

1.8MB
Sample

241023-t47bnascmq
MD5

6fe5c1089930e6c2ae5a6fd111cc1258
SHA1

bcd96f217181206b7728eb139b930b927ede84e0
SHA256

662c718a42dd20d117227761000cfc125d6060842014faa1fb96371ab67b52bd
SHA512

a02ef9e8597fe126dcf7934060174ae311f437055be3e32103cd4cd2ebfb89faa7290edec08fb651767617474fc60121af83fac8e2b50f928b91f1423c7dfa82
SSDEEP

49152:snInNRTh3h6QTbFA4xsOwaNYsBIc5mD9KwESJlZv:sCNVDPFyORPBIc5mrBv

Score

10^/10

discovery evasion execution

Malware Config

Targets

- Target
  
  6fe5c1089930e6c2ae5a6fd111cc1258_JaffaCakes118
- Size
  
  1.8MB
- MD5
  
  6fe5c1089930e6c2ae5a6fd111cc1258
- SHA1
  
  bcd96f217181206b7728eb139b930b927ede84e0
- SHA256
  
  662c718a42dd20d117227761000cfc125d6060842014faa1fb96371ab67b52bd
- SHA512
  
  a02ef9e8597fe126dcf7934060174ae311f437055be3e32103cd4cd2ebfb89faa7290edec08fb651767617474fc60121af83fac8e2b50f928b91f1423c7dfa82
- SSDEEP
  
  49152:snInNRTh3h6QTbFA4xsOwaNYsBIc5mD9KwESJlZv:sCNVDPFyORPBIc5mrBv
Score

10^/10

discovery evasion execution
- Disables service(s)
  evasion execution
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Command and Scripting Interpreter

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

discoveryevasionexecution

behavioral2

discoveryevasionexecution