76205a1337c68b4016ae904ba4e654e0562e465938041b9bcb63f66ec610c3f2 | Triage

Sharing

General

Target

040713ac423b13531a036424d5c55b3d_JaffaCakes118
Size

160KB
Sample

240620-ja5wmawcmg
MD5

040713ac423b13531a036424d5c55b3d
SHA1

da8cdf8bb2d89a3ff61bb5333f2231b18e0a49be
SHA256

76205a1337c68b4016ae904ba4e654e0562e465938041b9bcb63f66ec610c3f2
SHA512

39e382a536030d20413e1d954fea1e803be33ed0ce862ecc50c689e6dba423becd019df19acd2e49f2d5dccba1296fa82f01ef832917a5ed680ed94b2c57cfe6
SSDEEP

3072:BMSAAfLiKbFHka71tXOK7cPHqzQI+oNf:TV37cPHqzNVN

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  040713ac423b13531a036424d5c55b3d_JaffaCakes118
- Size
  
  160KB
- MD5
  
  040713ac423b13531a036424d5c55b3d
- SHA1
  
  da8cdf8bb2d89a3ff61bb5333f2231b18e0a49be
- SHA256
  
  76205a1337c68b4016ae904ba4e654e0562e465938041b9bcb63f66ec610c3f2
- SHA512
  
  39e382a536030d20413e1d954fea1e803be33ed0ce862ecc50c689e6dba423becd019df19acd2e49f2d5dccba1296fa82f01ef832917a5ed680ed94b2c57cfe6
- SSDEEP
  
  3072:BMSAAfLiKbFHka71tXOK7cPHqzQI+oNf:TV37cPHqzNVN
Score

10^/10

evasion persistence
- Modifies firewall policy service
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence