18b6f2fa21221a9de5a62dfa194ed7a8f15fcb7eb42beb618ccd8c1e69d090af | Triage

Sharing

General

Target

2532c567fc22c68524d1fa9ba2345164_JaffaCakes118
Size

70KB
Sample

240704-jvkq7ateld
MD5

2532c567fc22c68524d1fa9ba2345164
SHA1

7f5b2106c5c1e2a99a05acb6b58f216b37396c7f
SHA256

18b6f2fa21221a9de5a62dfa194ed7a8f15fcb7eb42beb618ccd8c1e69d090af
SHA512

263113fe93c0f77e4ac4795a642c336e36e3b49b7fa10567f78ce3c947d0705f1ca04aa3f4a27f109ad88e09cb7360c97741af135b9e59ed235f04ed9a3b7cac
SSDEEP

1536:R41IOJC/HwmjeFAuHL6B1xVJO6i4HQoe0FB58:i1dqSf0/OYHe

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  2532c567fc22c68524d1fa9ba2345164_JaffaCakes118
- Size
  
  70KB
- MD5
  
  2532c567fc22c68524d1fa9ba2345164
- SHA1
  
  7f5b2106c5c1e2a99a05acb6b58f216b37396c7f
- SHA256
  
  18b6f2fa21221a9de5a62dfa194ed7a8f15fcb7eb42beb618ccd8c1e69d090af
- SHA512
  
  263113fe93c0f77e4ac4795a642c336e36e3b49b7fa10567f78ce3c947d0705f1ca04aa3f4a27f109ad88e09cb7360c97741af135b9e59ed235f04ed9a3b7cac
- SSDEEP
  
  1536:R41IOJC/HwmjeFAuHL6B1xVJO6i4HQoe0FB58:i1dqSf0/OYHe
Score

7^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Modifies WinLogon
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2