76b1dd40eec3a3b10be8cad3b12581a2c8529fe13de89da1f92eb5145364f782 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

37252f9460247ca1000753aec9de94e9_JaffaCakes118
Size

14KB
Sample

240511-3m5k6sec81
MD5

37252f9460247ca1000753aec9de94e9
SHA1

3222203fec9988fb6f609f174e99830bb99e08c3
SHA256

76b1dd40eec3a3b10be8cad3b12581a2c8529fe13de89da1f92eb5145364f782
SHA512

4a24f351f50b15dfff581b79cf263c573e6a0c3068713e8e5be457729047cebfe15baaef13b165f3b79ecc1564d70a40887a0918b8d0a8ff60f546c1d3e0cfe7
SSDEEP

384:w2fkYLbi1JXKrpLl4WNLGrV+crANE+uwSifckyibGu8/NK:w2cYPWJXo5oxjE2zqbGv/g

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  Config-Installer.exe
- Size
  
  33KB
- MD5
  
  df103da7489a07e7c4682d76491b109f
- SHA1
  
  3eb662939f6fd65e8a8ee99573f51de56736b5b3
- SHA256
  
  1ca66a8720a93944b00b772c7bb11087d47449bda16d680e2bb41a340cd790c9
- SHA512
  
  c38c8fe084a89bf06e21194612be9dbc7a68fbdee8532d39926df60e62dff73b58d8cb75cc29800b2def2494ed8d3ea15433ef246cdfcd256f42b6eeb5bf0aa9
- SSDEEP
  
  384:2tVwdhpbwrOOlkmqqDDrUV2pFyRwQqwFyAdUMs3BPJLMmyUHVkw3ccNwifGIyLsB:2nwdhpbwrhJHlEwQqwF75w3ccrfLV0r
Score

8^/10

evasion persistence
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence