Overview

overview

8

Static

static

1

e9fb7427a1...18.vbs

windows7-x64

8

e9fb7427a1...18.vbs

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e9fb7427a18d483637609bd10854540b_JaffaCakes118

  • Size

    3KB

  • Sample

    240918-z3atystfll

  • MD5

    e9fb7427a18d483637609bd10854540b

  • SHA1

    50059fc753a57c9f46f1da60896f0aa1dee23a9e

  • SHA256

    feb20f5a97f74cba894ee6f84fb452adef5551c5471354346d4c45c6a8e89b80

  • SHA512

    9d88c1e94db05a5d039c81c34ff8cd711c0329fe7da6fdc4cffd56985d4005a3f0d1775a75f60eaf26cab17c235d9fb17fc31fa041cc7aabce5e69fc29e0ae45

Score
8/10
discoverypersistence

Malware Config

Targets

    • Target

      e9fb7427a18d483637609bd10854540b_JaffaCakes118

    • Size

      3KB

    • MD5

      e9fb7427a18d483637609bd10854540b

    • SHA1

      50059fc753a57c9f46f1da60896f0aa1dee23a9e

    • SHA256

      feb20f5a97f74cba894ee6f84fb452adef5551c5471354346d4c45c6a8e89b80

    • SHA512

      9d88c1e94db05a5d039c81c34ff8cd711c0329fe7da6fdc4cffd56985d4005a3f0d1775a75f60eaf26cab17c235d9fb17fc31fa041cc7aabce5e69fc29e0ae45

    Score
    8/10
    discoverypersistence

    • Blocklisted process makes network request

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks