Overview

overview

8

Static

static

3

be5c59b37d...18.exe

windows7-x64

8

be5c59b37d...18.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    be5c59b37d57dad8e50e45f8f3b0ce38_JaffaCakes118

  • Size

    17KB

  • Sample

    241203-vj61tsvjax

  • MD5

    be5c59b37d57dad8e50e45f8f3b0ce38

  • SHA1

    c6e88fc3822a0926090ad1dd02557207c5f04a23

  • SHA256

    86f14602208ac8af527879129dd5921709acc8708f4df9a01b9d49819f6d767b

  • SHA512

    f511df097d05413984a72746ae8b8b749f0f458ccbe887287e16348485a90f365b0f7a62ef643964dd94793e2fa139834730a74e691ad128552dc759c50140bf

  • SSDEEP

    384:HHk2+IjDjClbX/xzEobx8PD5NJEUUNHsMY/G7BQGjkPP7RohY:nkYEb5tePD/JEU0sMY/GqGjIPVohY

Score
8/10
defense_evasiondiscoverypersistence

Malware Config

Targets

    • Target

      be5c59b37d57dad8e50e45f8f3b0ce38_JaffaCakes118

    • Size

      17KB

    • MD5

      be5c59b37d57dad8e50e45f8f3b0ce38

    • SHA1

      c6e88fc3822a0926090ad1dd02557207c5f04a23

    • SHA256

      86f14602208ac8af527879129dd5921709acc8708f4df9a01b9d49819f6d767b

    • SHA512

      f511df097d05413984a72746ae8b8b749f0f458ccbe887287e16348485a90f365b0f7a62ef643964dd94793e2fa139834730a74e691ad128552dc759c50140bf

    • SSDEEP

      384:HHk2+IjDjClbX/xzEobx8PD5NJEUUNHsMY/G7BQGjkPP7RohY:nkYEb5tePD/JEU0sMY/GqGjIPVohY

    Score
    8/10
    defense_evasiondiscoverypersistence

    • Adds policy Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks