4efefd8b0713d163eb63a8275d2ffbe54744a3aefd3a1cf3cae3554ae65609d0 | Triage

Sharing

General

Target

ed8b389ad909e9070be66576ba10cd64_JaffaCakes118
Size

100KB
Sample

240920-n75dkswanq
MD5

ed8b389ad909e9070be66576ba10cd64
SHA1

96b4b7b9de945ea94a30420c467a874327e12b77
SHA256

4efefd8b0713d163eb63a8275d2ffbe54744a3aefd3a1cf3cae3554ae65609d0
SHA512

986e543ebab14f769654dde033b7b2ba3d2376b663ddc6c88622d5f7b6054f502866759c9713673ad1153bb57750f6090be496efc191c8c11904da3b90c3b16b
SSDEEP

1536:tAtGY82NTzweMGAc4ohrPXo+73Rez8b0SyuNIjnZq:qwBurPX7CuCnY

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  ed8b389ad909e9070be66576ba10cd64_JaffaCakes118
- Size
  
  100KB
- MD5
  
  ed8b389ad909e9070be66576ba10cd64
- SHA1
  
  96b4b7b9de945ea94a30420c467a874327e12b77
- SHA256
  
  4efefd8b0713d163eb63a8275d2ffbe54744a3aefd3a1cf3cae3554ae65609d0
- SHA512
  
  986e543ebab14f769654dde033b7b2ba3d2376b663ddc6c88622d5f7b6054f502866759c9713673ad1153bb57750f6090be496efc191c8c11904da3b90c3b16b
- SSDEEP
  
  1536:tAtGY82NTzweMGAc4ohrPXo+73Rez8b0SyuNIjnZq:qwBurPX7CuCnY
Score

10^/10

discovery evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence