5092d179585b593f0dde154d9a2faea4e6fd12eb387bc37255db97be7eca6ff6 | Triage

Sharing

General

Target

21012d62a838dc37a068999ad1952716_JaffaCakes118
Size

540KB
Sample

240703-ejx5xswfle
MD5

21012d62a838dc37a068999ad1952716
SHA1

5b61cffdb878029d871940e2147c39ed3326ba57
SHA256

5092d179585b593f0dde154d9a2faea4e6fd12eb387bc37255db97be7eca6ff6
SHA512

f49a2b60cd519a50169407562d3391ea307fae923bb7f71356cb02975c212c88c73ea90a546b1e739c840e2ffb87199abb246c6359e027e7fa4fb950e2a4ba67
SSDEEP

6144:JQp+JFxjMwfEDLHlH7vUONYAVa+1a4KxTvb:Ji+PxTfEDLFbv9zb1aBxTvb

Score

8^/10

evasion execution persistence

Malware Config

Targets

- Target
  
  21012d62a838dc37a068999ad1952716_JaffaCakes118
- Size
  
  540KB
- MD5
  
  21012d62a838dc37a068999ad1952716
- SHA1
  
  5b61cffdb878029d871940e2147c39ed3326ba57
- SHA256
  
  5092d179585b593f0dde154d9a2faea4e6fd12eb387bc37255db97be7eca6ff6
- SHA512
  
  f49a2b60cd519a50169407562d3391ea307fae923bb7f71356cb02975c212c88c73ea90a546b1e739c840e2ffb87199abb246c6359e027e7fa4fb950e2a4ba67
- SSDEEP
  
  6144:JQp+JFxjMwfEDLHlH7vUONYAVa+1a4KxTvb:Ji+PxTfEDLFbv9zb1aBxTvb
Score

8^/10

evasion execution persistence
- Stops running service(s)
  evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Boot or Logon Autostart Execution

Time Providers

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Time Providers

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

evasionexecutionpersistence

behavioral2