de95903113d5fc7d9fd4937f84e1532756f67f38e491fa75d9a3cd828da167c8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

91f23f85ec633a2a1089ad0f1b94f6c5_JaffaCakes118
Size

969KB
Sample

240603-qpre4shc84
MD5

91f23f85ec633a2a1089ad0f1b94f6c5
SHA1

6220cb7a10c8c7ca29920b91c1740a97d1222994
SHA256

de95903113d5fc7d9fd4937f84e1532756f67f38e491fa75d9a3cd828da167c8
SHA512

780882f4e42ad89268f1e3f33d9806a6ed44a35124dc00db7905fcb21c8ddec4b74adfa151692b7c94afcc8e4ba4fb7bf8e02ede9a9efe9e9516ba46b4a45ed8
SSDEEP

12288:HEBGiMiMWHrqbfjhepnH0IlQcXJGD1p0cXKUgtlysiw:HEAqHrqDEdUcXJsD0Tjiw

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  91f23f85ec633a2a1089ad0f1b94f6c5_JaffaCakes118
- Size
  
  969KB
- MD5
  
  91f23f85ec633a2a1089ad0f1b94f6c5
- SHA1
  
  6220cb7a10c8c7ca29920b91c1740a97d1222994
- SHA256
  
  de95903113d5fc7d9fd4937f84e1532756f67f38e491fa75d9a3cd828da167c8
- SHA512
  
  780882f4e42ad89268f1e3f33d9806a6ed44a35124dc00db7905fcb21c8ddec4b74adfa151692b7c94afcc8e4ba4fb7bf8e02ede9a9efe9e9516ba46b4a45ed8
- SSDEEP
  
  12288:HEBGiMiMWHrqbfjhepnH0IlQcXJGD1p0cXKUgtlysiw:HEAqHrqDEdUcXJsD0Tjiw
Score

8^/10

persistence
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Checks for any installed AV software in registry
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Software Discovery

Security Software Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2