69a6a47e17e6345a9d3d586b588886c321522dafe840159352383b4122ad7547 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0618e5b7cc3eee23fd76a6b916710f60_JaffaCakes118
Size

53KB
Sample

240620-pzdrbsscpj
MD5

0618e5b7cc3eee23fd76a6b916710f60
SHA1

3623eb25501a7c3633df52aa81b510744e18b9fb
SHA256

69a6a47e17e6345a9d3d586b588886c321522dafe840159352383b4122ad7547
SHA512

445d6f65e8e2f782924f87576644f33177f1a7a9d0aa2b76209dfce1c23f4a3489de8d0d0c08b3e144676b8670da930c5aacda5b0b15aebca195b7aecae65450
SSDEEP

1536:oUgJQgPH4eyS+yGcBqW4gWD3iOwtMniUoAoKL:HgPF/hlBqW4xLaMeAo

Score

7^/10

persistence upx

Malware Config

Targets

- Target
  
  0618e5b7cc3eee23fd76a6b916710f60_JaffaCakes118
- Size
  
  53KB
- MD5
  
  0618e5b7cc3eee23fd76a6b916710f60
- SHA1
  
  3623eb25501a7c3633df52aa81b510744e18b9fb
- SHA256
  
  69a6a47e17e6345a9d3d586b588886c321522dafe840159352383b4122ad7547
- SHA512
  
  445d6f65e8e2f782924f87576644f33177f1a7a9d0aa2b76209dfce1c23f4a3489de8d0d0c08b3e144676b8670da930c5aacda5b0b15aebca195b7aecae65450
- SSDEEP
  
  1536:oUgJQgPH4eyS+yGcBqW4gWD3iOwtMniUoAoKL:HgPF/hlBqW4xLaMeAo
Score

7^/10

persistence upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2