d69c7020eeb7de540f830d03515ec2250e38ea65d3d07c193cdceab91690352c | Triage

Sharing

General

Target

23ba6264867c529085c766f6b984db80_JaffaCakes118
Size

152KB
Sample

240329-q7wgsaaa2z
MD5

23ba6264867c529085c766f6b984db80
SHA1

a5509ce39be3b00ce89fccc497cba46348648d3b
SHA256

d69c7020eeb7de540f830d03515ec2250e38ea65d3d07c193cdceab91690352c
SHA512

c8981dce82651071ce17351cc84d85ba5ead1a1c73bdc35311e705400c8a7b293360b9a6580b793b96c9b5f3bd5ce4e116cdd069bdd3d8f2191cf9c0ecba8a7f
SSDEEP

3072:gbpfhDOW7hBhr4pX5r9x29E9z5HpZDGunCc9/0Q7BWDjIIO0r9bD6G:UJhBhrAXvQE9hPD7l08BkjIf0r9bWG

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  23ba6264867c529085c766f6b984db80_JaffaCakes118
- Size
  
  152KB
- MD5
  
  23ba6264867c529085c766f6b984db80
- SHA1
  
  a5509ce39be3b00ce89fccc497cba46348648d3b
- SHA256
  
  d69c7020eeb7de540f830d03515ec2250e38ea65d3d07c193cdceab91690352c
- SHA512
  
  c8981dce82651071ce17351cc84d85ba5ead1a1c73bdc35311e705400c8a7b293360b9a6580b793b96c9b5f3bd5ce4e116cdd069bdd3d8f2191cf9c0ecba8a7f
- SSDEEP
  
  3072:gbpfhDOW7hBhr4pX5r9x29E9z5HpZDGunCc9/0Q7BWDjIIO0r9bD6G:UJhBhrAXvQE9hPD7l08BkjIf0r9bWG
Score

7^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2