987c1baa340a6edb444f953c4d3b68f9899e03366f88e2c20d91b445221e2326 | Triage

Sharing

General

Target

c24f5ad9b1044507470deb08ceb02c42_JaffaCakes118
Size

45KB
Sample

240826-fd9r7sxcrk
MD5

c24f5ad9b1044507470deb08ceb02c42
SHA1

247a5e56d91e3463169012c0df6d89fe5b9232e9
SHA256

987c1baa340a6edb444f953c4d3b68f9899e03366f88e2c20d91b445221e2326
SHA512

2a76ce318c793f4bdcab737eb335deb30a3f49f0e860ab041a88ba21dcf82e7cd480db8f0d0c75f3766b8c93ecb0b9460343977c6a0e2d0f27f3cf96124e0e9c
SSDEEP

768:LRVZwlephZYNuRrIKM/GsNEpFjEf8o688PUQ0Zbnwzoxz5FhVkdvDya:LRAephXq/hxf36JUjZhxdFhKdvL

Score

8^/10

defense_evasion discovery evasion persistence

Malware Config

Targets

- Target
  
  c24f5ad9b1044507470deb08ceb02c42_JaffaCakes118
- Size
  
  45KB
- MD5
  
  c24f5ad9b1044507470deb08ceb02c42
- SHA1
  
  247a5e56d91e3463169012c0df6d89fe5b9232e9
- SHA256
  
  987c1baa340a6edb444f953c4d3b68f9899e03366f88e2c20d91b445221e2326
- SHA512
  
  2a76ce318c793f4bdcab737eb335deb30a3f49f0e860ab041a88ba21dcf82e7cd480db8f0d0c75f3766b8c93ecb0b9460343977c6a0e2d0f27f3cf96124e0e9c
- SSDEEP
  
  768:LRVZwlephZYNuRrIKM/GsNEpFjEf8o688PUQ0Zbnwzoxz5FhVkdvDya:LRAephXq/hxf36JUjZhxdFhKdvL
Score

8^/10

discovery defense_evasion evasion persistence
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

defense_evasiondiscoveryevasionpersistence