d51013bd4266368371c03eb8599f0aac7d8bf04bad5e5d17f9ea20b0cdecbf85 | Triage

Sharing

General

Target

ed6c07ebe768f29baa4c0c87e8b6a157_JaffaCakes118
Size

216KB
Sample

240920-mwmhyssdkh
MD5

ed6c07ebe768f29baa4c0c87e8b6a157
SHA1

735394457c169e56d0902a6aaed6fcfc81e9934f
SHA256

d51013bd4266368371c03eb8599f0aac7d8bf04bad5e5d17f9ea20b0cdecbf85
SHA512

00639deeae83519a55e913867b52b0c116cb30ebb069513b7b1506d3859237732b27c632675ba68716b94a2173f89972bcd429243890d0a26f0870da9ef06f9b
SSDEEP

3072:bYwaMKGz6cBewR7sEVSdJplM2IlNGzBkl9s+q:M+JBe2pV2M2CWs9

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  ed6c07ebe768f29baa4c0c87e8b6a157_JaffaCakes118
- Size
  
  216KB
- MD5
  
  ed6c07ebe768f29baa4c0c87e8b6a157
- SHA1
  
  735394457c169e56d0902a6aaed6fcfc81e9934f
- SHA256
  
  d51013bd4266368371c03eb8599f0aac7d8bf04bad5e5d17f9ea20b0cdecbf85
- SHA512
  
  00639deeae83519a55e913867b52b0c116cb30ebb069513b7b1506d3859237732b27c632675ba68716b94a2173f89972bcd429243890d0a26f0870da9ef06f9b
- SSDEEP
  
  3072:bYwaMKGz6cBewR7sEVSdJplM2IlNGzBkl9s+q:M+JBe2pV2M2CWs9
Score

10^/10

discovery evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence