529a66b8d66850a28d401cc8dd77681335c39f1f0f4835a1701f3acab84836aa | Triage

Sharing

General

Target

ac5b74bde9b37320fd66c2f25281e7a4_JaffaCakes118
Size

60KB
Sample

240819-ymyqeasgph
MD5

ac5b74bde9b37320fd66c2f25281e7a4
SHA1

0a0c13ec0441ffb4c3f791cc48917efc3477d37f
SHA256

529a66b8d66850a28d401cc8dd77681335c39f1f0f4835a1701f3acab84836aa
SHA512

656ae787f908845bbca7f222583b79e43435f72d156678dff6fd94f122b06afaf3faf848f8ec1d0d87aa3aabd74c92b4d0ae43f82eae210a9cc5ae9739dc7df1
SSDEEP

768:2E7RUeILeOWS9st/XtDe3huf484Eu9HyClEB904/m82ojQ+yGdf:aeVtFDIRXE9d/mKM+yGZ

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  ac5b74bde9b37320fd66c2f25281e7a4_JaffaCakes118
- Size
  
  60KB
- MD5
  
  ac5b74bde9b37320fd66c2f25281e7a4
- SHA1
  
  0a0c13ec0441ffb4c3f791cc48917efc3477d37f
- SHA256
  
  529a66b8d66850a28d401cc8dd77681335c39f1f0f4835a1701f3acab84836aa
- SHA512
  
  656ae787f908845bbca7f222583b79e43435f72d156678dff6fd94f122b06afaf3faf848f8ec1d0d87aa3aabd74c92b4d0ae43f82eae210a9cc5ae9739dc7df1
- SSDEEP
  
  768:2E7RUeILeOWS9st/XtDe3huf484Eu9HyClEB904/m82ojQ+yGdf:aeVtFDIRXE9d/mKM+yGZ
Score

10^/10

evasion persistence trojan
- UAC bypass
  evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables RegEdit via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan