5554b40aa6810e1c6f720ab2f90c216c08a95e864666c81313ec44dbdee76d52 | Triage

Sharing

General

Target

47b787fefce21508ef8408e9f404267d_JaffaCakes118
Size

844KB
Sample

240715-b836pavene
MD5

47b787fefce21508ef8408e9f404267d
SHA1

61ac910a258eddab027f27eb5cacb9b66f20fcf5
SHA256

5554b40aa6810e1c6f720ab2f90c216c08a95e864666c81313ec44dbdee76d52
SHA512

36103a07604c3f355a9834ad2d1008f2e54a88941970e2f37a57548564bb7d1fa58fd7cb8f0e22003e9e3c5e5678a8881fe3dcfe9d10e793379637ecd088f60b
SSDEEP

24576:lOZUrs2MwgQgyVAXPK3J/6ZcTxIIuTdj1xsLCi:LPVl/6STxIIadTsL7

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  47b787fefce21508ef8408e9f404267d_JaffaCakes118
- Size
  
  844KB
- MD5
  
  47b787fefce21508ef8408e9f404267d
- SHA1
  
  61ac910a258eddab027f27eb5cacb9b66f20fcf5
- SHA256
  
  5554b40aa6810e1c6f720ab2f90c216c08a95e864666c81313ec44dbdee76d52
- SHA512
  
  36103a07604c3f355a9834ad2d1008f2e54a88941970e2f37a57548564bb7d1fa58fd7cb8f0e22003e9e3c5e5678a8881fe3dcfe9d10e793379637ecd088f60b
- SSDEEP
  
  24576:lOZUrs2MwgQgyVAXPK3J/6ZcTxIIuTdj1xsLCi:LPVl/6STxIIadTsL7
Score

10^/10

evasion persistence
- Modifies firewall policy service
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence