4c90b28f4b8d54050b22c7c70f9fdb839be6b50ef5b5fac29e7218aa3928a3de | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a1adb34bbf888991934a1fc9d1278c5f_JaffaCakes118
Size

6.6MB
Sample

240612-ws828avbng
MD5

a1adb34bbf888991934a1fc9d1278c5f
SHA1

42633a6bf5b04373208c0f800ed3ace189e24b09
SHA256

4c90b28f4b8d54050b22c7c70f9fdb839be6b50ef5b5fac29e7218aa3928a3de
SHA512

9735239e1317dba21fadb68554f10d83db29872a96bf49bab63e98f4816b5809b1c164befff69397c02d2f068becbf9964baa39433de8e9dabdfd0dea5014d45
SSDEEP

196608:oR47BGZehMcrXKdBeY08LbDzZrdyE5XaiA0OUQ6IX61f+GujL2:o47BaehMcrXKdBeY/Zrzc0Op6IXEf+Gb

Score

6^/10

discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  a1adb34bbf888991934a1fc9d1278c5f_JaffaCakes118
- Size
  
  6.6MB
- MD5
  
  a1adb34bbf888991934a1fc9d1278c5f
- SHA1
  
  42633a6bf5b04373208c0f800ed3ace189e24b09
- SHA256
  
  4c90b28f4b8d54050b22c7c70f9fdb839be6b50ef5b5fac29e7218aa3928a3de
- SHA512
  
  9735239e1317dba21fadb68554f10d83db29872a96bf49bab63e98f4816b5809b1c164befff69397c02d2f068becbf9964baa39433de8e9dabdfd0dea5014d45
- SSDEEP
  
  196608:oR47BGZehMcrXKdBeY08LbDzZrdyE5XaiA0OUQ6IX61f+GujL2:o47BaehMcrXKdBeY/Zrzc0Op6IXEf+Gb
Score

6^/10

discovery evasion persistence trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencetrojan

behavioral2

discoveryevasionpersistencetrojan