46749934b318871406e7590a8cb47de074bf5fe8a27529b8b7b32ccf32f54fa5 | Triage

Sharing

General

Target

d6222819a89f890c953e82fc35b0d344_JaffaCakes118
Size

536KB
Sample

240909-mkx6bawbnd
MD5

d6222819a89f890c953e82fc35b0d344
SHA1

d46bbd7436bae229ad24f7c5e95d55fd477c7f29
SHA256

46749934b318871406e7590a8cb47de074bf5fe8a27529b8b7b32ccf32f54fa5
SHA512

45136f7c396668b195a63af5c204f3492217df6f8cc57ef331a1afd8d4f77cd678f739ea8c9dec39fc0d55a0d44c4364675e65dd4bc50fec6a3b9c72b9a0c933
SSDEEP

12288:glMMnMMMMMUv4v2NTBVkgHuXFzgR3sMMVVWt6t1oTk8yAKt:glMMnMMMMMQ4O9uNgxHIQwosNt

Score

8^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  d6222819a89f890c953e82fc35b0d344_JaffaCakes118
- Size
  
  536KB
- MD5
  
  d6222819a89f890c953e82fc35b0d344
- SHA1
  
  d46bbd7436bae229ad24f7c5e95d55fd477c7f29
- SHA256
  
  46749934b318871406e7590a8cb47de074bf5fe8a27529b8b7b32ccf32f54fa5
- SHA512
  
  45136f7c396668b195a63af5c204f3492217df6f8cc57ef331a1afd8d4f77cd678f739ea8c9dec39fc0d55a0d44c4364675e65dd4bc50fec6a3b9c72b9a0c933
- SSDEEP
  
  12288:glMMnMMMMMUv4v2NTBVkgHuXFzgR3sMMVVWt6t1oTk8yAKt:glMMnMMMMMQ4O9uNgxHIQwosNt
Score

8^/10

discovery evasion persistence
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence