80f3e5dd2001b73fa54d340684fb5e4bd20cef1bc2dfc0cf61964b012c14d39e | Triage

Sharing

General

Target

165e122dd5fc0567b2da9b4f7e7a1a19_JaffaCakes118
Size

15.9MB
Sample

240329-c5evcsgb33
MD5

165e122dd5fc0567b2da9b4f7e7a1a19
SHA1

f7d0f4d592455e30f1a622d6a8d156dcd39f37c0
SHA256

80f3e5dd2001b73fa54d340684fb5e4bd20cef1bc2dfc0cf61964b012c14d39e
SHA512

e6af81543eb3eb6e2826c0d20f5d3bfd427cf1bd5fac2811065491967b9de9b9be66ed026aa8a1b813d3486bd7c47acc706497204074975194e425cd6e71131e
SSDEEP

393216:kg7ucg7ucg7ucg7ucg7ucg7ucg7ucg7uv:5ShShShShShShShSv

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  165e122dd5fc0567b2da9b4f7e7a1a19_JaffaCakes118
- Size
  
  15.9MB
- MD5
  
  165e122dd5fc0567b2da9b4f7e7a1a19
- SHA1
  
  f7d0f4d592455e30f1a622d6a8d156dcd39f37c0
- SHA256
  
  80f3e5dd2001b73fa54d340684fb5e4bd20cef1bc2dfc0cf61964b012c14d39e
- SHA512
  
  e6af81543eb3eb6e2826c0d20f5d3bfd427cf1bd5fac2811065491967b9de9b9be66ed026aa8a1b813d3486bd7c47acc706497204074975194e425cd6e71131e
- SSDEEP
  
  393216:kg7ucg7ucg7ucg7ucg7ucg7ucg7ucg7uv:5ShShShShShShShSv
Score

7^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2