493e306492d95f29b6784d49b17b06d9fe55c139e719b6fafd57e1d3a3e99be8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

062505869911797f23bd1208a8a4e3e8_JaffaCakes118
Size

44KB
Sample

240620-p3spnaybja
MD5

062505869911797f23bd1208a8a4e3e8
SHA1

4c1eaf63f65901ae02b70868513f22c90dc3ba1c
SHA256

493e306492d95f29b6784d49b17b06d9fe55c139e719b6fafd57e1d3a3e99be8
SHA512

bf745eea787a3d1af9a403eab062364118cc2b5efa213db7551ea09edb80108d148790979276f775579c445a640ebb91ff959027dd199970e3a99205b11d6040
SSDEEP

768:tx1sFA6O0GH8TIygDN4tlQB+XJCnXfzaln+N9ZPvNLYJ+l4Y3rUlRoermzDsF2OO:P1sC6O0GH8TIygDN4tlQcXJCnXfzaln4

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  062505869911797f23bd1208a8a4e3e8_JaffaCakes118
- Size
  
  44KB
- MD5
  
  062505869911797f23bd1208a8a4e3e8
- SHA1
  
  4c1eaf63f65901ae02b70868513f22c90dc3ba1c
- SHA256
  
  493e306492d95f29b6784d49b17b06d9fe55c139e719b6fafd57e1d3a3e99be8
- SHA512
  
  bf745eea787a3d1af9a403eab062364118cc2b5efa213db7551ea09edb80108d148790979276f775579c445a640ebb91ff959027dd199970e3a99205b11d6040
- SSDEEP
  
  768:tx1sFA6O0GH8TIygDN4tlQB+XJCnXfzaln+N9ZPvNLYJ+l4Y3rUlRoermzDsF2OO:P1sC6O0GH8TIygDN4tlQcXJCnXfzaln4
Score

7^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2