2987f6544e7533d0fc7a9f06a6beef344f636ed793f83f6e8d0e10e957d0a2c5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

18dac4d8e28213980c88e2d4b151abaf_JaffaCakes118
Size

65KB
Sample

240628-flg26avemj
MD5

18dac4d8e28213980c88e2d4b151abaf
SHA1

49e71f67595591681037a2da13795e73cf6e1cb1
SHA256

2987f6544e7533d0fc7a9f06a6beef344f636ed793f83f6e8d0e10e957d0a2c5
SHA512

7be3b54976d6e7f3c386d47612aa6ab8d91036e1a113086d06e5706fa863e1139ae600dce0258549c12a84e1c3ed6e5105764517322ae7ecf67b18b9c95857bf
SSDEEP

1536:GwJCm2/RHfsnZX23GiogXmYwE/3dAsiAqL9yWmOZs:ZCmwHfsnZX23Giog2PEFA5L9ynOZs

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  18dac4d8e28213980c88e2d4b151abaf_JaffaCakes118
- Size
  
  65KB
- MD5
  
  18dac4d8e28213980c88e2d4b151abaf
- SHA1
  
  49e71f67595591681037a2da13795e73cf6e1cb1
- SHA256
  
  2987f6544e7533d0fc7a9f06a6beef344f636ed793f83f6e8d0e10e957d0a2c5
- SHA512
  
  7be3b54976d6e7f3c386d47612aa6ab8d91036e1a113086d06e5706fa863e1139ae600dce0258549c12a84e1c3ed6e5105764517322ae7ecf67b18b9c95857bf
- SSDEEP
  
  1536:GwJCm2/RHfsnZX23GiogXmYwE/3dAsiAqL9yWmOZs:ZCmwHfsnZX23Giog2PEFA5L9ynOZs
Score

7^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Change Default File Association

Privilege Escalation

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2