d96f41e1cbc63e78c02ee5e7047f0c587e9d0deb7924bbdae17ecd8c85c3d6bf | Triage

Sharing

Copy URL Twitter E-mail

General

Target

439d3d3e329bd1d28145a04b38de58e5_JaffaCakes118
Size

840KB
Sample

240713-2g62dascqe
MD5

439d3d3e329bd1d28145a04b38de58e5
SHA1

c3e3cd667deff5d2b1bab782804ec33d275782ed
SHA256

d96f41e1cbc63e78c02ee5e7047f0c587e9d0deb7924bbdae17ecd8c85c3d6bf
SHA512

79f5a63ba53bfa794c9afec455bbb6fe7501a8d8d9f5a5ecc6f86882b5d6d40ee317461dc6808a38d7cd7a4401f6ec70a61cf46c1128bf9773da507246be4cdc
SSDEEP

24576:XZRlzK96yLMBjbgDdpN3TcE9dgEEguRWzU1lyUUHLJiTkPFl6rKyUNb:MJIgDdpN3TcCT18fU

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  439d3d3e329bd1d28145a04b38de58e5_JaffaCakes118
- Size
  
  840KB
- MD5
  
  439d3d3e329bd1d28145a04b38de58e5
- SHA1
  
  c3e3cd667deff5d2b1bab782804ec33d275782ed
- SHA256
  
  d96f41e1cbc63e78c02ee5e7047f0c587e9d0deb7924bbdae17ecd8c85c3d6bf
- SHA512
  
  79f5a63ba53bfa794c9afec455bbb6fe7501a8d8d9f5a5ecc6f86882b5d6d40ee317461dc6808a38d7cd7a4401f6ec70a61cf46c1128bf9773da507246be4cdc
- SSDEEP
  
  24576:XZRlzK96yLMBjbgDdpN3TcE9dgEEguRWzU1lyUUHLJiTkPFl6rKyUNb:MJIgDdpN3TcCT18fU
Score

10^/10

evasion persistence
- Modifies firewall policy service
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence