6975340ece36232d60bc1f02d736fd3568c0ef73cb142b0ba6a22c2a61abe3c7 | Triage

Sharing

General

Target

ef0a79f2b25c57c96e9ce16f2c89b0fd_JaffaCakes118
Size

144KB
Sample

240921-eqs5jsvaqm
MD5

ef0a79f2b25c57c96e9ce16f2c89b0fd
SHA1

8287a4eaf0ee7a09bd8f357c443598f42aa52422
SHA256

6975340ece36232d60bc1f02d736fd3568c0ef73cb142b0ba6a22c2a61abe3c7
SHA512

3592bc6e1451e48dd648c6efe1c28ba41e364ffd69630ae7058428712ad244dbbef22a63d16f0db39fbba54f531f7e7576dfc87f744fb079f9d4565fe008f362
SSDEEP

3072:NTJZTlzxfdX850eJKLPQ7BLQLh4meagEHTxakmdH0uevCg:NTfTlzxfdXe0eYL4q14mHgEzAkmneq

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  ef0a79f2b25c57c96e9ce16f2c89b0fd_JaffaCakes118
- Size
  
  144KB
- MD5
  
  ef0a79f2b25c57c96e9ce16f2c89b0fd
- SHA1
  
  8287a4eaf0ee7a09bd8f357c443598f42aa52422
- SHA256
  
  6975340ece36232d60bc1f02d736fd3568c0ef73cb142b0ba6a22c2a61abe3c7
- SHA512
  
  3592bc6e1451e48dd648c6efe1c28ba41e364ffd69630ae7058428712ad244dbbef22a63d16f0db39fbba54f531f7e7576dfc87f744fb079f9d4565fe008f362
- SSDEEP
  
  3072:NTJZTlzxfdX850eJKLPQ7BLQLh4meagEHTxakmdH0uevCg:NTfTlzxfdXe0eYL4q14mHgEzAkmneq
Score

10^/10

discovery evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence