General

  • Target

    a1d768f3068d783c375380ec85cea715_JaffaCakes118

  • Size

    250KB

  • Sample

    240817-kc9s2azapp

  • MD5

    a1d768f3068d783c375380ec85cea715

  • SHA1

    728f40d004e3013dee504459a4545365f30966dc

  • SHA256

    d03d0e0d5ba6fe251bd6561e023aa8999abaaf3ada6ace8be6ab9b532ca29e86

  • SHA512

    6fda133d1a1f49acceb7b06778eb33292f99b8b82ce474f1678032f35ab288a5d74df64bdfbe8d700bfc3f82dc914cf2dbfd472c09ce872b4e120057203ca4d0

  • SSDEEP

    6144:2hieuJDr5T8b2ufqBLjSB/MS7irtIa6cwoD8ZroSfjGFA:zeKrJJuf86AYcwoaoSbr

Malware Config

Targets

    • Target

      a1d768f3068d783c375380ec85cea715_JaffaCakes118

    • Size

      250KB

    • MD5

      a1d768f3068d783c375380ec85cea715

    • SHA1

      728f40d004e3013dee504459a4545365f30966dc

    • SHA256

      d03d0e0d5ba6fe251bd6561e023aa8999abaaf3ada6ace8be6ab9b532ca29e86

    • SHA512

      6fda133d1a1f49acceb7b06778eb33292f99b8b82ce474f1678032f35ab288a5d74df64bdfbe8d700bfc3f82dc914cf2dbfd472c09ce872b4e120057203ca4d0

    • SSDEEP

      6144:2hieuJDr5T8b2ufqBLjSB/MS7irtIa6cwoD8ZroSfjGFA:zeKrJJuf86AYcwoaoSbr

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

MITRE ATT&CK Enterprise v15

Tasks