e273a2e1bd4d11d9303ed263ecea25f87c3ee9d22704db0e1646bb30bfc33090 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

19129cacf45399319c821ffb8e90ac3c_JaffaCakes118
Size

494KB
Sample

240628-gzmp8svela
MD5

19129cacf45399319c821ffb8e90ac3c
SHA1

ebbddc89cafaebb34f2b5b7097d84e43f8f000fb
SHA256

e273a2e1bd4d11d9303ed263ecea25f87c3ee9d22704db0e1646bb30bfc33090
SHA512

5f5fc9cfd3c2c58eac51323b4e57331869008051e26c3f9b376cf0f6dc7807e9d95468ef5bde69b006bc90f278a1fa8d1c265096f629b2b025a71c51be82c466
SSDEEP

12288:fTxXKGorEaIWo9AUQ4pC3pdMdgZUNy/TjY:pn8IWo9bQ4ep6dgZUNB

Score

10^/10

evasion execution persistence

Malware Config

Targets

- Target
  
  19129cacf45399319c821ffb8e90ac3c_JaffaCakes118
- Size
  
  494KB
- MD5
  
  19129cacf45399319c821ffb8e90ac3c
- SHA1
  
  ebbddc89cafaebb34f2b5b7097d84e43f8f000fb
- SHA256
  
  e273a2e1bd4d11d9303ed263ecea25f87c3ee9d22704db0e1646bb30bfc33090
- SHA512
  
  5f5fc9cfd3c2c58eac51323b4e57331869008051e26c3f9b376cf0f6dc7807e9d95468ef5bde69b006bc90f278a1fa8d1c265096f629b2b025a71c51be82c466
- SSDEEP
  
  12288:fTxXKGorEaIWo9AUQ4pC3pdMdgZUNy/TjY:pn8IWo9bQ4ep6dgZUNB
Score

10^/10

evasion execution persistence
- Disables service(s)
  evasion execution
- Modifies WinLogon for persistence
  persistence
- Stops running service(s)
  evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

evasionexecutionpersistence

behavioral2

evasionexecutionpersistence