d505102f281b50059fa3aa47db2bc51cc64856a1370be9e2d5b413c095eef75c | Triage

Sharing

General

Target

6591a44686aec2745b46cf319b46c274_JaffaCakes118
Size

337KB
Sample

240522-b6b97age9z
MD5

6591a44686aec2745b46cf319b46c274
SHA1

5c0562803d3c16419f8276f41040ef554cf332c6
SHA256

d505102f281b50059fa3aa47db2bc51cc64856a1370be9e2d5b413c095eef75c
SHA512

07c1c3d2b2c3bd70e61edf8a850c3fc87cd32d37c65ef328d3901e7dc3f0f8bdbef108c40011cf58f100cc6881744407d757694b885dd0165dd74aeea53dd86e
SSDEEP

6144:Qe3HOHQimIWK/9mktFlABh/8KDdOIfWMNNSSuul5AzsmBdrZK:SHQimIW5sUkmPLNNSful5A4MG

Score

8^/10

execution persistence

Malware Config

Targets

- Target
  
  6591a44686aec2745b46cf319b46c274_JaffaCakes118
- Size
  
  337KB
- MD5
  
  6591a44686aec2745b46cf319b46c274
- SHA1
  
  5c0562803d3c16419f8276f41040ef554cf332c6
- SHA256
  
  d505102f281b50059fa3aa47db2bc51cc64856a1370be9e2d5b413c095eef75c
- SHA512
  
  07c1c3d2b2c3bd70e61edf8a850c3fc87cd32d37c65ef328d3901e7dc3f0f8bdbef108c40011cf58f100cc6881744407d757694b885dd0165dd74aeea53dd86e
- SSDEEP
  
  6144:Qe3HOHQimIWK/9mktFlABh/8KDdOIfWMNNSSuul5AzsmBdrZK:SHQimIW5sUkmPLNNSful5A4MG
Score

8^/10

execution persistence
- Creates new service(s)
  persistence execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

executionpersistence

behavioral2