e3e9001f99f25b4426fdd2c5b7853258cf8888fa38a87574bfad5303927489e8 | Triage

Sharing

General

Target

954e547bddf4a06357626c86acf67405_JaffaCakes118
Size

2.7MB
Sample

240814-j8v43ssapf
MD5

954e547bddf4a06357626c86acf67405
SHA1

5471a251c88bc888ea0ea370bd0e04eabc96de8c
SHA256

e3e9001f99f25b4426fdd2c5b7853258cf8888fa38a87574bfad5303927489e8
SHA512

6c7855b5f0f9091ac964c8de260df224ace10125cba77b6c8a74df5d0372e241f275d6d007c55b4a22e94b26dc26d307c2c7d1d469034167aec33d88ec943235
SSDEEP

49152:TehDiNSs+pfWw41NGEKIt0YYYYYYYYYYYYYYYiYYYYYYYYYYYYYYYWDYYYYYYYYn:ensJwwNGlIt0YYYYYYYYYYYYYYYiYYYm

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  954e547bddf4a06357626c86acf67405_JaffaCakes118
- Size
  
  2.7MB
- MD5
  
  954e547bddf4a06357626c86acf67405
- SHA1
  
  5471a251c88bc888ea0ea370bd0e04eabc96de8c
- SHA256
  
  e3e9001f99f25b4426fdd2c5b7853258cf8888fa38a87574bfad5303927489e8
- SHA512
  
  6c7855b5f0f9091ac964c8de260df224ace10125cba77b6c8a74df5d0372e241f275d6d007c55b4a22e94b26dc26d307c2c7d1d469034167aec33d88ec943235
- SSDEEP
  
  49152:TehDiNSs+pfWw41NGEKIt0YYYYYYYYYYYYYYYiYYYYYYYYYYYYYYYWDYYYYYYYYn:ensJwwNGlIt0YYYYYYYYYYYYYYYiYYYm
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoverypersistence