22b134515cabe07b358b6bc8139301452b6056553ac1d0df5449b616d2599879 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b3a79a6580432a85e94bc45cddf454fa_JaffaCakes118
Size

437KB
Sample

240821-qte8ms1clb
MD5

b3a79a6580432a85e94bc45cddf454fa
SHA1

4fa1d5f78dd5e5ae16cb0d2ed82ddc62583deb31
SHA256

22b134515cabe07b358b6bc8139301452b6056553ac1d0df5449b616d2599879
SHA512

5ac7171949904828695dbe4b7feef27382a76d8abbc6c3e6be45b5ded6ab318ebd3b6dacac631a5535a7c06f27c443e14c4159a1338e0282bc635eaff8b75bd3
SSDEEP

12288:/mgUwoz5bubi02VViLksY2ixG9MFPk0FhMs:lUwoz5bM2VVEOzxCMFPkop

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  b3a79a6580432a85e94bc45cddf454fa_JaffaCakes118
- Size
  
  437KB
- MD5
  
  b3a79a6580432a85e94bc45cddf454fa
- SHA1
  
  4fa1d5f78dd5e5ae16cb0d2ed82ddc62583deb31
- SHA256
  
  22b134515cabe07b358b6bc8139301452b6056553ac1d0df5449b616d2599879
- SHA512
  
  5ac7171949904828695dbe4b7feef27382a76d8abbc6c3e6be45b5ded6ab318ebd3b6dacac631a5535a7c06f27c443e14c4159a1338e0282bc635eaff8b75bd3
- SSDEEP
  
  12288:/mgUwoz5bubi02VViLksY2ixG9MFPk0FhMs:lUwoz5bM2VVEOzxCMFPkop
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence