15c5562106322fdda0eab69a1bf690441b795c4e5952df2c33544efbb158ba5d | Triage

Sharing

General

Target

ea97cc6001b00f6fe34d96920acffc6d_JaffaCakes118
Size

3.5MB
Sample

240919-e6k4wa1dmf
MD5

ea97cc6001b00f6fe34d96920acffc6d
SHA1

c5503c03c4aa1b74afe9840b96844514f4be4e0d
SHA256

15c5562106322fdda0eab69a1bf690441b795c4e5952df2c33544efbb158ba5d
SHA512

14b51c9573b46d2ebb085bedad9c78edb1ceaa2b58ac45eaf657e69d75ef9698199ca343f28963977d7b8221ce503b067673e62db02ca5e0ccff8eaa836276f7
SSDEEP

98304:Oyy2iucHf29EdSFAxvgTCyZH+ZIlphMN/+TYR4U:WfdoYgLCIlM2YRB

Score

9^/10

discovery evasion execution

Malware Config

Targets

- Target
  
  ea97cc6001b00f6fe34d96920acffc6d_JaffaCakes118
- Size
  
  3.5MB
- MD5
  
  ea97cc6001b00f6fe34d96920acffc6d
- SHA1
  
  c5503c03c4aa1b74afe9840b96844514f4be4e0d
- SHA256
  
  15c5562106322fdda0eab69a1bf690441b795c4e5952df2c33544efbb158ba5d
- SHA512
  
  14b51c9573b46d2ebb085bedad9c78edb1ceaa2b58ac45eaf657e69d75ef9698199ca343f28963977d7b8221ce503b067673e62db02ca5e0ccff8eaa836276f7
- SSDEEP
  
  98304:Oyy2iucHf29EdSFAxvgTCyZH+ZIlphMN/+TYR4U:WfdoYgLCIlM2YRB
Score

9^/10

discovery evasion execution
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Process Discovery

Query Registry

Software Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionexecution

behavioral2

discoveryevasionexecution