154f527e047019bb07534b7e7898dfe72118b1a4ed0c98af29955c22199f88b8 | Triage

Sharing

General

Target

84887aba098bd8bc0a628bb8473eb929_JaffaCakes118
Size

236KB
Sample

241101-vgs17avjek
MD5

84887aba098bd8bc0a628bb8473eb929
SHA1

70e7046832bb4e3440d859d1f43dc94d53f55124
SHA256

154f527e047019bb07534b7e7898dfe72118b1a4ed0c98af29955c22199f88b8
SHA512

fb3776d53eb991133611a29812ebe425edc643982e7d06c83eed76bc8fc1c915b36a0dc072ca613fcbbb688a5c0ffbd559fca5eeebe5b6b17232c7a307257e79
SSDEEP

6144:2omR1EzYbPCS8WsD7s0FU6ykbsdb/y99z9tnL9O99999N9999V999996999WLf9u:2R

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  84887aba098bd8bc0a628bb8473eb929_JaffaCakes118
- Size
  
  236KB
- MD5
  
  84887aba098bd8bc0a628bb8473eb929
- SHA1
  
  70e7046832bb4e3440d859d1f43dc94d53f55124
- SHA256
  
  154f527e047019bb07534b7e7898dfe72118b1a4ed0c98af29955c22199f88b8
- SHA512
  
  fb3776d53eb991133611a29812ebe425edc643982e7d06c83eed76bc8fc1c915b36a0dc072ca613fcbbb688a5c0ffbd559fca5eeebe5b6b17232c7a307257e79
- SSDEEP
  
  6144:2omR1EzYbPCS8WsD7s0FU6ykbsdb/y99z9tnL9O99999N9999V999996999WLf9u:2R
Score

10^/10

discovery evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence