2b5787df6ed239a961633ae2a29d1041354cf488f8ac17b22f8472bd228b33d7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ff097549c9496ee483cb74adda7cd949_JaffaCakes118
Size

15.9MB
Sample

240421-l5cvfagh5t
MD5

ff097549c9496ee483cb74adda7cd949
SHA1

61aed381c951ca473710e0bb4955b8c13d3ab629
SHA256

2b5787df6ed239a961633ae2a29d1041354cf488f8ac17b22f8472bd228b33d7
SHA512

87c35fde33c86b8420d0ab872fa541642551e1a871f8b2d3e4139e2e5fbd9b99b9fc2a30c4890bcb6ce5b7b7e1a0f49a24c548e587ce870b3bb3343531c34ac3
SSDEEP

393216:ig7uAg7uAg7uAg7uAg7uAg7uAg7uAg7uN:fStStStStStStStSN

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  ff097549c9496ee483cb74adda7cd949_JaffaCakes118
- Size
  
  15.9MB
- MD5
  
  ff097549c9496ee483cb74adda7cd949
- SHA1
  
  61aed381c951ca473710e0bb4955b8c13d3ab629
- SHA256
  
  2b5787df6ed239a961633ae2a29d1041354cf488f8ac17b22f8472bd228b33d7
- SHA512
  
  87c35fde33c86b8420d0ab872fa541642551e1a871f8b2d3e4139e2e5fbd9b99b9fc2a30c4890bcb6ce5b7b7e1a0f49a24c548e587ce870b3bb3343531c34ac3
- SSDEEP
  
  393216:ig7uAg7uAg7uAg7uAg7uAg7uAg7uAg7uN:fStStStStStStStSN
Score

7^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2