22d34c4e45800b1cc6667aa7d2a6afd044aaf0456e0b86e6b150cdab1a5a9eee | Triage

Sharing

General

Target

c0b9b35382d8ce1eb9214a345cb426aa_JaffaCakes118
Size

1.5MB
Sample

240825-pem49svgkq
MD5

c0b9b35382d8ce1eb9214a345cb426aa
SHA1

1f6c920ad895a55313c2577089fa9dfe6a4863d2
SHA256

22d34c4e45800b1cc6667aa7d2a6afd044aaf0456e0b86e6b150cdab1a5a9eee
SHA512

23b42a6c523ab5fd436a5e8155817608be56c8ba2ffbecaa613a19f7c9cdaebac4e5d91bfe086a2ab0f12cfb07ee363ef6603195fd288fce6991ed6a2ee8aad5
SSDEEP

24576:SMG0BU5hg49JASpliJt/ZxZcoCfih32WyOzhTUT738kRi:SUBU5hpJASpIJp7NCQ38shgT7M+i

Score

8^/10

discovery

Malware Config

Targets

- Target
  
  c0b9b35382d8ce1eb9214a345cb426aa_JaffaCakes118
- Size
  
  1.5MB
- MD5
  
  c0b9b35382d8ce1eb9214a345cb426aa
- SHA1
  
  1f6c920ad895a55313c2577089fa9dfe6a4863d2
- SHA256
  
  22d34c4e45800b1cc6667aa7d2a6afd044aaf0456e0b86e6b150cdab1a5a9eee
- SHA512
  
  23b42a6c523ab5fd436a5e8155817608be56c8ba2ffbecaa613a19f7c9cdaebac4e5d91bfe086a2ab0f12cfb07ee363ef6603195fd288fce6991ed6a2ee8aad5
- SSDEEP
  
  24576:SMG0BU5hg49JASpliJt/ZxZcoCfih32WyOzhTUT738kRi:SUBU5hpJASpIJp7NCQ38shgT7M+i
Score

8^/10

discovery
- Blocklisted process makes network request
- Deletes itself
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2