44f53e2ca552f49ce5803a4139e09957c14422cfbc7e6ee5df445e16e4b2c4ce | Triage

Sharing

General

Target

406330f4abd0aff45ebc657b5b37560c_JaffaCakes118
Size

68KB
Sample

240713-f9expszenc
MD5

406330f4abd0aff45ebc657b5b37560c
SHA1

7b38374a0bd219475158941d004dc055a44fd28c
SHA256

44f53e2ca552f49ce5803a4139e09957c14422cfbc7e6ee5df445e16e4b2c4ce
SHA512

36c7541442d8cd902a9e775b58b43cab90132f04a1067a9b5ae94ec7b11b9a1fef20bca709237a79bb22c460da90118605eae592dcb08d610d9b436d311193cc
SSDEEP

1536:cj+x2UHc9nMXoML9atF9mV78oe1jDzeDCrqo/11s:bpaTQaw8ACr11s

Score

8^/10

evasion execution persistence trojan

Malware Config

Targets

- Target
  
  406330f4abd0aff45ebc657b5b37560c_JaffaCakes118
- Size
  
  68KB
- MD5
  
  406330f4abd0aff45ebc657b5b37560c
- SHA1
  
  7b38374a0bd219475158941d004dc055a44fd28c
- SHA256
  
  44f53e2ca552f49ce5803a4139e09957c14422cfbc7e6ee5df445e16e4b2c4ce
- SHA512
  
  36c7541442d8cd902a9e775b58b43cab90132f04a1067a9b5ae94ec7b11b9a1fef20bca709237a79bb22c460da90118605eae592dcb08d610d9b436d311193cc
- SSDEEP
  
  1536:cj+x2UHc9nMXoML9atF9mV78oe1jDzeDCrqo/11s:bpaTQaw8ACr11s
Score

8^/10

evasion execution persistence trojan
- Creates new service(s)
  persistence execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

System Services

Service Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionexecutionpersistencetrojan

behavioral2

evasionexecutionpersistencetrojan