Overview

overview

8

Static

static

3

fc3c2e5b1d...18.exe

windows7-x64

8

fc3c2e5b1d...18.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fc3c2e5b1df6fc003987363171bb4798_JaffaCakes118

  • Size

    637KB

  • Sample

    240420-h8zltscb71

  • MD5

    fc3c2e5b1df6fc003987363171bb4798

  • SHA1

    7aeb894742bbe79ff4bbb29f038db7878b4a3327

  • SHA256

    d05dc070814c52b512ff4aa1fd83caaf1ddf229bd09afee773c8305531185491

  • SHA512

    c4946a69f24de2b88d20e8e39a29b44bb183d40a9c1780df36a2796f1c41717350867e46ad0dffdb14f2c8ed270b7c9bcd519f68a49c158369fbd7617193f3ca

  • SSDEEP

    12288:ocv0NTBL22JUyhO42c95ZSzb0MLcqNUOq6MeC+Hxl0zLBW6zZCFpSZr6ptMRp:ocvkTBICJSNLbLHxlqLdsMZitMRp

Score
8/10
discoveryexploitpersistence

Malware Config

Targets

    • Target

      fc3c2e5b1df6fc003987363171bb4798_JaffaCakes118

    • Size

      637KB

    • MD5

      fc3c2e5b1df6fc003987363171bb4798

    • SHA1

      7aeb894742bbe79ff4bbb29f038db7878b4a3327

    • SHA256

      d05dc070814c52b512ff4aa1fd83caaf1ddf229bd09afee773c8305531185491

    • SHA512

      c4946a69f24de2b88d20e8e39a29b44bb183d40a9c1780df36a2796f1c41717350867e46ad0dffdb14f2c8ed270b7c9bcd519f68a49c158369fbd7617193f3ca

    • SSDEEP

      12288:ocv0NTBL22JUyhO42c95ZSzb0MLcqNUOq6MeC+Hxl0zLBW6zZCFpSZr6ptMRp:ocvkTBICJSNLbLHxlqLdsMZitMRp

    Score
    8/10
    discoveryexploitpersistence

    • Modifies Installed Components in the registry

      persistence

    • Possible privilege escalation attempt

      exploit

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

File and Directory Permissions Modification

1
T1222

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

2
T1120

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks