c2f76ee6aa8f218e960926beb62fd69139eba55eee459f0651a98cc9ac806add | Triage

Sharing

General

Target

ed367dab295de456f86d3bb87c471bb3_JaffaCakes118
Size

218KB
Sample

240920-kf9mfaxgqn
MD5

ed367dab295de456f86d3bb87c471bb3
SHA1

47f28e25106ce0a8b2f55f767b2e90f927183319
SHA256

c2f76ee6aa8f218e960926beb62fd69139eba55eee459f0651a98cc9ac806add
SHA512

e24acf6fdddde4dc7aa8b9197fb7431045fd5320a90701c4c392cf77458827ce97f10bc5994679bfd37d9ec20f7092e6bc8b4872f39f92b064b7866f1df3f903
SSDEEP

6144:nc+yiZtsqepeFe5bc2pIHhY18Nih7uawcs:n9y2tsqmmYbclHq1e+yawc

Score

10^/10

defense_evasion discovery evasion persistence trojan upx

Malware Config

Targets

- Target
  
  ed367dab295de456f86d3bb87c471bb3_JaffaCakes118
- Size
  
  218KB
- MD5
  
  ed367dab295de456f86d3bb87c471bb3
- SHA1
  
  47f28e25106ce0a8b2f55f767b2e90f927183319
- SHA256
  
  c2f76ee6aa8f218e960926beb62fd69139eba55eee459f0651a98cc9ac806add
- SHA512
  
  e24acf6fdddde4dc7aa8b9197fb7431045fd5320a90701c4c392cf77458827ce97f10bc5994679bfd37d9ec20f7092e6bc8b4872f39f92b064b7866f1df3f903
- SSDEEP
  
  6144:nc+yiZtsqepeFe5bc2pIHhY18Nih7uawcs:n9y2tsqmmYbclHq1e+yawc
Score

10^/10

defense_evasion discovery evasion persistence trojan upx
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Hide Artifacts

Hidden Files and Directories

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionpersistencetrojanupx

behavioral2

defense_evasiondiscoveryevasionupx