c3361a1e2b6514648a7e04f7fb9d1517dddcfd9b3f9f084f3b878af5ce736544 | Triage

Sharing

General

Target

07934d9ea2efd2842933a1a30b96246b_JaffaCakes118
Size

119KB
Sample

240624-kxcc9stgpb
MD5

07934d9ea2efd2842933a1a30b96246b
SHA1

95a9f52b75424f9af7e10446e550cad742ee3b62
SHA256

c3361a1e2b6514648a7e04f7fb9d1517dddcfd9b3f9f084f3b878af5ce736544
SHA512

ec2e8300c627b1a1bd6b8a5c64e349bd69847592baade4750b81e0ed96a08395e7c60739f3a6fc321426e172fc1f943caa99ef8ae58a546db2bb04aab9baae89
SSDEEP

3072:HblRvw5H9BtpvlqMtFALyaG9SByVfDy4kQJBrvUTa:Hbla5Hf3LF/uyVfDypKVvm

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  07934d9ea2efd2842933a1a30b96246b_JaffaCakes118
- Size
  
  119KB
- MD5
  
  07934d9ea2efd2842933a1a30b96246b
- SHA1
  
  95a9f52b75424f9af7e10446e550cad742ee3b62
- SHA256
  
  c3361a1e2b6514648a7e04f7fb9d1517dddcfd9b3f9f084f3b878af5ce736544
- SHA512
  
  ec2e8300c627b1a1bd6b8a5c64e349bd69847592baade4750b81e0ed96a08395e7c60739f3a6fc321426e172fc1f943caa99ef8ae58a546db2bb04aab9baae89
- SSDEEP
  
  3072:HblRvw5H9BtpvlqMtFALyaG9SByVfDy4kQJBrvUTa:Hbla5Hf3LF/uyVfDypKVvm
Score

7^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2