20e62ed17ca794095e63da91f59ba3a5473064bb894a911ea3cfa437bca7e9fc | Triage

Sharing

General

Target

3b8a308e37cc4b3b8a14295d565b5f47_JaffaCakes118
Size

337KB
Sample

240512-xbzb5aag8s
MD5

3b8a308e37cc4b3b8a14295d565b5f47
SHA1

b1f70d0efffb718975b616f8c91ea22e0e2bd506
SHA256

20e62ed17ca794095e63da91f59ba3a5473064bb894a911ea3cfa437bca7e9fc
SHA512

c9871a5164f7be30c932c93828687545a5aefd49292b3dd1034dbe2766e6898a12f7f6ccb408e42334c84a1f8080dd08b014f788b6d4451ac954bd513cd6207f
SSDEEP

6144:jYJbOaUmbGk1FImOkYv4JHMzyp4Tnmhgbig7:0JbOYBXImTJHMzWhpg7

Score

8^/10

execution persistence

Malware Config

Targets

- Target
  
  3b8a308e37cc4b3b8a14295d565b5f47_JaffaCakes118
- Size
  
  337KB
- MD5
  
  3b8a308e37cc4b3b8a14295d565b5f47
- SHA1
  
  b1f70d0efffb718975b616f8c91ea22e0e2bd506
- SHA256
  
  20e62ed17ca794095e63da91f59ba3a5473064bb894a911ea3cfa437bca7e9fc
- SHA512
  
  c9871a5164f7be30c932c93828687545a5aefd49292b3dd1034dbe2766e6898a12f7f6ccb408e42334c84a1f8080dd08b014f788b6d4451ac954bd513cd6207f
- SSDEEP
  
  6144:jYJbOaUmbGk1FImOkYv4JHMzyp4Tnmhgbig7:0JbOYBXImTJHMzWhpg7
Score

8^/10

execution persistence
- Creates new service(s)
  persistence execution
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

executionpersistence

behavioral2

executionpersistence