General

  • Target

    82325c92109a19266fc3195801558fef_JaffaCakes118

  • Size

    264KB

  • Sample

    241031-h1eaxstaqa

  • MD5

    82325c92109a19266fc3195801558fef

  • SHA1

    fdb19b88fb7d136487a4316883ce23acf06afffb

  • SHA256

    d24557340b7bd8f3eb37bfe2f3f0017487319e545543b3db2a2b467fa225354d

  • SHA512

    053df51c4eb913789d565ca7c2270d479cdb753813ac74ca2f9af0742f132d83ada50671810dd8daec480293233dc89462a5d4ead51091f59d941cd7bea3e755

  • SSDEEP

    3072:ZYUb5QoJ4g+Ri+Zj6Iz1ZdW4SrO7FSVpuJR:ZY7xh6SZI4z7FSVpuJR

Malware Config

Targets

    • Target

      82325c92109a19266fc3195801558fef_JaffaCakes118

    • Size

      264KB

    • MD5

      82325c92109a19266fc3195801558fef

    • SHA1

      fdb19b88fb7d136487a4316883ce23acf06afffb

    • SHA256

      d24557340b7bd8f3eb37bfe2f3f0017487319e545543b3db2a2b467fa225354d

    • SHA512

      053df51c4eb913789d565ca7c2270d479cdb753813ac74ca2f9af0742f132d83ada50671810dd8daec480293233dc89462a5d4ead51091f59d941cd7bea3e755

    • SSDEEP

      3072:ZYUb5QoJ4g+Ri+Zj6Iz1ZdW4SrO7FSVpuJR:ZY7xh6SZI4z7FSVpuJR

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks