e3f7d1bc1299c2ec2047038870316a2ce73b6a3fc48886e036127d972a40e749 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

39f20943a5b09fa815ef415615686e25_JaffaCakes118
Size

70KB
Sample

240711-t8t7wsvfjl
MD5

39f20943a5b09fa815ef415615686e25
SHA1

c1a7dc018a075039f474f961bda33d6d10086b09
SHA256

e3f7d1bc1299c2ec2047038870316a2ce73b6a3fc48886e036127d972a40e749
SHA512

0a1490165041e5d5a744a9f33b9166b4cba2030e6ce1e64128cc797434e6aa8f65d0ce8b2ad3040be318699d0e6235ff29c66f19f48b19cb628efa871e97cf37
SSDEEP

1536:+4jQCP+0x5yN94B0gaV54OzlTMhuJLn3m+hvXZc:+pCB5yNqBuVFzcuJDm+5Jc

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  39f20943a5b09fa815ef415615686e25_JaffaCakes118
- Size
  
  70KB
- MD5
  
  39f20943a5b09fa815ef415615686e25
- SHA1
  
  c1a7dc018a075039f474f961bda33d6d10086b09
- SHA256
  
  e3f7d1bc1299c2ec2047038870316a2ce73b6a3fc48886e036127d972a40e749
- SHA512
  
  0a1490165041e5d5a744a9f33b9166b4cba2030e6ce1e64128cc797434e6aa8f65d0ce8b2ad3040be318699d0e6235ff29c66f19f48b19cb628efa871e97cf37
- SSDEEP
  
  1536:+4jQCP+0x5yN94B0gaV54OzlTMhuJLn3m+hvXZc:+pCB5yNqBuVFzcuJDm+5Jc
Score

10^/10

evasion persistence
- Modifies firewall policy service
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence