d401b5a5601d7627dbf5d30c1d35d68cae585379edffff0f07af6d51acdf7a91 | Triage

Sharing

General

Target

f12584cc1e4943cbda70f3f05438d8db_JaffaCakes118
Size

996KB
Sample

240415-qjzjjafc49
MD5

f12584cc1e4943cbda70f3f05438d8db
SHA1

b8b091074cf1f529c0b34f77d0a08e5575c3bdc2
SHA256

d401b5a5601d7627dbf5d30c1d35d68cae585379edffff0f07af6d51acdf7a91
SHA512

611f1a4b7d7fdf4b81aaf8930f01c54459e64a4affdce8812c5040676763f67830107fde09caec8a26191a56078ac0c66caeea3557a9531b0a523602535d36cd
SSDEEP

12288:58kxNhOZElO5kkWjhD4Ar8kxNhOZElO5kkWjhD4A:SqEkfFIqEkfF

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  f12584cc1e4943cbda70f3f05438d8db_JaffaCakes118
- Size
  
  996KB
- MD5
  
  f12584cc1e4943cbda70f3f05438d8db
- SHA1
  
  b8b091074cf1f529c0b34f77d0a08e5575c3bdc2
- SHA256
  
  d401b5a5601d7627dbf5d30c1d35d68cae585379edffff0f07af6d51acdf7a91
- SHA512
  
  611f1a4b7d7fdf4b81aaf8930f01c54459e64a4affdce8812c5040676763f67830107fde09caec8a26191a56078ac0c66caeea3557a9531b0a523602535d36cd
- SSDEEP
  
  12288:58kxNhOZElO5kkWjhD4Ar8kxNhOZElO5kkWjhD4A:SqEkfFIqEkfF
Score

7^/10

persistence
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2