d69832863be30bc74a17f95967378d0d1493458f7d8fabaf23a0539dcc316b82 | Triage

Sharing

General

Target

eac53f3f6078b8c1ff6e60d63a8d5482_JaffaCakes118
Size

529KB
Sample

240919-hcvm1awakn
MD5

eac53f3f6078b8c1ff6e60d63a8d5482
SHA1

b5cfd64884d295b7b2d3b1626e1146c62b19db08
SHA256

d69832863be30bc74a17f95967378d0d1493458f7d8fabaf23a0539dcc316b82
SHA512

7449bef80797cb05ee1e0e5c3950ba2f877a922d1206ad2c123cccfc6cc934ea24c00e1eac21cd2b867aef12456cab6ef23c042591d101b1b991310969b655a0
SSDEEP

12288:6JwtfO/Ovo23XnDJrTjq2oFX6POwOfbw+CX3MMnMMMMMt17:6JwVqOvRnDJDq29OwAq3MMnMMMMMt17

Score

8^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  eac53f3f6078b8c1ff6e60d63a8d5482_JaffaCakes118
- Size
  
  529KB
- MD5
  
  eac53f3f6078b8c1ff6e60d63a8d5482
- SHA1
  
  b5cfd64884d295b7b2d3b1626e1146c62b19db08
- SHA256
  
  d69832863be30bc74a17f95967378d0d1493458f7d8fabaf23a0539dcc316b82
- SHA512
  
  7449bef80797cb05ee1e0e5c3950ba2f877a922d1206ad2c123cccfc6cc934ea24c00e1eac21cd2b867aef12456cab6ef23c042591d101b1b991310969b655a0
- SSDEEP
  
  12288:6JwtfO/Ovo23XnDJrTjq2oFX6POwOfbw+CX3MMnMMMMMt17:6JwVqOvRnDJDq29OwAq3MMnMMMMMt17
Score

8^/10

discovery evasion persistence
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence