a1e85c2367d8d120742d665601e03e452873e6b67ac9e5d81cfd25b9584071ef | Triage

Sharing

General

Target

fd7b8cbb361e2c2ea3cf4ffe73c486c5_JaffaCakes118
Size

88KB
Sample

240929-a8hdjswejh
MD5

fd7b8cbb361e2c2ea3cf4ffe73c486c5
SHA1

3fa63a2074b4aac228a9ddaba2f7858ae720d1d0
SHA256

a1e85c2367d8d120742d665601e03e452873e6b67ac9e5d81cfd25b9584071ef
SHA512

8281f2b10713373e71e7ac5b889bfe7d65ec3fde38de4bb6e3833d9c75cf6c28a166221ff1aecf68eb4672287ffc126ea3ea3a4824c0105d2fd2074abd024283
SSDEEP

768:dDFICtwgJRaaq2AOa6TnwVDZ1RO8YSEQJt1H7a8jFk+Zxqfcwlkpw:XIED7YzDZ16SEQJjZx0cwlMw

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  fd7b8cbb361e2c2ea3cf4ffe73c486c5_JaffaCakes118
- Size
  
  88KB
- MD5
  
  fd7b8cbb361e2c2ea3cf4ffe73c486c5
- SHA1
  
  3fa63a2074b4aac228a9ddaba2f7858ae720d1d0
- SHA256
  
  a1e85c2367d8d120742d665601e03e452873e6b67ac9e5d81cfd25b9584071ef
- SHA512
  
  8281f2b10713373e71e7ac5b889bfe7d65ec3fde38de4bb6e3833d9c75cf6c28a166221ff1aecf68eb4672287ffc126ea3ea3a4824c0105d2fd2074abd024283
- SSDEEP
  
  768:dDFICtwgJRaaq2AOa6TnwVDZ1RO8YSEQJt1H7a8jFk+Zxqfcwlkpw:XIED7YzDZ16SEQJjZx0cwlMw
Score

10^/10

discovery evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence