7b5049e7fb4d20779a0c6f5f3a77947538ea47459116611f920a1dde5703b1d8 | Triage

Sharing

General

Target

6fd8c62c82ebd5cd4ad2d9de767d151d_JaffaCakes118
Size

81KB
Sample

241023-twfhza1gpp
MD5

6fd8c62c82ebd5cd4ad2d9de767d151d
SHA1

f50c5d78881c7ed8cabf497a8771421d18a15526
SHA256

7b5049e7fb4d20779a0c6f5f3a77947538ea47459116611f920a1dde5703b1d8
SHA512

9e704c0bc0901d28fa4d370884cbb0842f51068a9539f5650fdfbe16e00afa47894a3bd92382a66a613ae64459734a731153f550a627b1241a0a9f4c3187f27e
SSDEEP

1536:IVB/zNZp2Nnx7Zcu6wx95kOlykeniDIrReqXhfrdrVCixZhN4KQb2iAQw:IVBbN/8nDcu6wx9WMjeik9eshZrLxZhc

Score

7^/10

defense_evasion discovery

Malware Config

Targets

- Target
  
  6fd8c62c82ebd5cd4ad2d9de767d151d_JaffaCakes118
- Size
  
  81KB
- MD5
  
  6fd8c62c82ebd5cd4ad2d9de767d151d
- SHA1
  
  f50c5d78881c7ed8cabf497a8771421d18a15526
- SHA256
  
  7b5049e7fb4d20779a0c6f5f3a77947538ea47459116611f920a1dde5703b1d8
- SHA512
  
  9e704c0bc0901d28fa4d370884cbb0842f51068a9539f5650fdfbe16e00afa47894a3bd92382a66a613ae64459734a731153f550a627b1241a0a9f4c3187f27e
- SSDEEP
  
  1536:IVB/zNZp2Nnx7Zcu6wx95kOlykeniDIrReqXhfrdrVCixZhN4KQb2iAQw:IVBbN/8nDcu6wx9WMjeik9eshZrLxZhc
Score

7^/10

defense_evasion discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

File Deletion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscovery

behavioral2

defense_evasiondiscovery