d126bab2b1b571d369da3bf978f1573e6670d2d5a73cdcb1cc031e8396f2a293 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

27f5f3b431d159dd058210156d7d94ae_JaffaCakes118
Size

244KB
Sample

240706-ksy2gashpn
MD5

27f5f3b431d159dd058210156d7d94ae
SHA1

b0ba53092865155787b8058a470971b875ceef65
SHA256

d126bab2b1b571d369da3bf978f1573e6670d2d5a73cdcb1cc031e8396f2a293
SHA512

516ec9511c41fe01b410af4084127f450199e2be8535081149e901622bca7fd15bd206ad7016ee7a8439d1be44aef60fb60dca63eb5fb380c214d0ea013c5598
SSDEEP

6144:l58IQr7HrLIoNNMAZTbXioa81LnQLoqUIRvp3T:PLQr7HrvL1Rn0IIRvt

Score

10^/10

persistence

Malware Config

Targets

- Target
  
  27f5f3b431d159dd058210156d7d94ae_JaffaCakes118
- Size
  
  244KB
- MD5
  
  27f5f3b431d159dd058210156d7d94ae
- SHA1
  
  b0ba53092865155787b8058a470971b875ceef65
- SHA256
  
  d126bab2b1b571d369da3bf978f1573e6670d2d5a73cdcb1cc031e8396f2a293
- SHA512
  
  516ec9511c41fe01b410af4084127f450199e2be8535081149e901622bca7fd15bd206ad7016ee7a8439d1be44aef60fb60dca63eb5fb380c214d0ea013c5598
- SSDEEP
  
  6144:l58IQr7HrLIoNNMAZTbXioa81LnQLoqUIRvp3T:PLQr7HrvL1Rn0IIRvt
Score

10^/10

persistence
- Modifies WinLogon for persistence
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2