Overview

overview

8

Static

static

3

aa65483e4d...18.exe

windows7-x64

8

aa65483e4d...18.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118

  • Size

    103KB

  • Sample

    240819-m7ex9atflr

  • MD5

    aa65483e4d8cd10c7ce8bacc309bc0b1

  • SHA1

    5e4b25626f3606a6ea7669074659fb544441bf81

  • SHA256

    574b02890cf382dd0571e15ae8888e80ac37124813136ea17c68491c3699e488

  • SHA512

    740e226540a9dec5c75876295c80ff587d0cd4a123dedc7f77728488a706ed3bf0c39381f1ea8977e6a9e6cf3211a42f778d51e5be8c50416616d174fe8ae9a6

  • SSDEEP

    1536:dl7ZhWzeiygbFdmg1h55r1JpHdXyjTqfvQi5Xz/RFnrHCLo/D+RLjajKBaMTZ+yE:dVZhAeiygbrVyjmntzTkG+RXtaMt5CUg

Score
8/10
defense_evasiondiscoverypersistence

Malware Config

Targets

    • Target

      aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118

    • Size

      103KB

    • MD5

      aa65483e4d8cd10c7ce8bacc309bc0b1

    • SHA1

      5e4b25626f3606a6ea7669074659fb544441bf81

    • SHA256

      574b02890cf382dd0571e15ae8888e80ac37124813136ea17c68491c3699e488

    • SHA512

      740e226540a9dec5c75876295c80ff587d0cd4a123dedc7f77728488a706ed3bf0c39381f1ea8977e6a9e6cf3211a42f778d51e5be8c50416616d174fe8ae9a6

    • SSDEEP

      1536:dl7ZhWzeiygbFdmg1h55r1JpHdXyjTqfvQi5Xz/RFnrHCLo/D+RLjajKBaMTZ+yE:dVZhAeiygbrVyjmntzTkG+RXtaMt5CUg

    Score
    8/10
    defense_evasiondiscoverypersistence

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Remote System Discovery

1
T1018

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks