74085bb82f1c6a233535f605438e52412598835789f6c56fd77a177b14c5fedf | Triage

Sharing

Copy URL Twitter E-mail

General

Target

419c3b77c6db506a79b56600679a0b5b_JaffaCakes118
Size

496KB
Sample

240514-qeaplsge6s
MD5

419c3b77c6db506a79b56600679a0b5b
SHA1

e5d70536018bedb4a89a65caef0a04de7462559e
SHA256

74085bb82f1c6a233535f605438e52412598835789f6c56fd77a177b14c5fedf
SHA512

ce0f2c1a433fe6a07d7fbd11b60ce6d78b3457ab5ef4365190f4e49c93489587a5b10ee2d25035af60482d395c96b52961302bbf6d1345f514242611db55f613
SSDEEP

6144:Zynculrso4MRHh7SUtHTiwh+0dzTN7iy5mSsItZZastgvxZNIo/qcB9:ZyhINUh7Lr1t7SCZtMZNIIqU9

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  419c3b77c6db506a79b56600679a0b5b_JaffaCakes118
- Size
  
  496KB
- MD5
  
  419c3b77c6db506a79b56600679a0b5b
- SHA1
  
  e5d70536018bedb4a89a65caef0a04de7462559e
- SHA256
  
  74085bb82f1c6a233535f605438e52412598835789f6c56fd77a177b14c5fedf
- SHA512
  
  ce0f2c1a433fe6a07d7fbd11b60ce6d78b3457ab5ef4365190f4e49c93489587a5b10ee2d25035af60482d395c96b52961302bbf6d1345f514242611db55f613
- SSDEEP
  
  6144:Zynculrso4MRHh7SUtHTiwh+0dzTN7iy5mSsItZZastgvxZNIo/qcB9:ZyhINUh7Lr1t7SCZtMZNIIqU9
Score

8^/10

persistence discovery
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoverypersistence