bf25a507b3956931819dbc7a8e88554e7f1758467244c8604e3fbd3fc8de0db5 | Triage

Sharing

General

Target

26263185370d3950c2550a7462940e74_JaffaCakes118
Size

62KB
Sample

240704-zjfk4axgpq
MD5

26263185370d3950c2550a7462940e74
SHA1

683f72e330a8b69d1360569c38b8884188bcfd68
SHA256

bf25a507b3956931819dbc7a8e88554e7f1758467244c8604e3fbd3fc8de0db5
SHA512

bf97809b096facf0d675260915dbdf46c618320d39727bd5d0e485a1a3555de111f93407d22de62628970a60ba12ac2f6b30fc09ff6e82c1f41c03274a9c074b
SSDEEP

1536:l43X0dQhLCEQbqsKK7r7YZllMi1afYQOvi1:lT+hLCjFj/G7MnwI

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  26263185370d3950c2550a7462940e74_JaffaCakes118
- Size
  
  62KB
- MD5
  
  26263185370d3950c2550a7462940e74
- SHA1
  
  683f72e330a8b69d1360569c38b8884188bcfd68
- SHA256
  
  bf25a507b3956931819dbc7a8e88554e7f1758467244c8604e3fbd3fc8de0db5
- SHA512
  
  bf97809b096facf0d675260915dbdf46c618320d39727bd5d0e485a1a3555de111f93407d22de62628970a60ba12ac2f6b30fc09ff6e82c1f41c03274a9c074b
- SSDEEP
  
  1536:l43X0dQhLCEQbqsKK7r7YZllMi1afYQOvi1:lT+hLCjFj/G7MnwI
Score

7^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2