787153d0db8844cb0f61152232529c9c13c3bfbc052d10f69e0d9a632e0add36 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4d9edfca0a206f8af57b7199590a4fbf_JaffaCakes118
Size

391KB
Sample

240716-kw669axdje
MD5

4d9edfca0a206f8af57b7199590a4fbf
SHA1

59d9f43da6262ecaad69fd942555fc91fdcd4e2f
SHA256

787153d0db8844cb0f61152232529c9c13c3bfbc052d10f69e0d9a632e0add36
SHA512

a9ab4de0d8e74e3a84eefefad598ce113ae110acaa6897e2b850974029e201003ac1755c397a233b1039c34d60d9917ff45d8417b03a9a5b7c32ffce982a80e6
SSDEEP

6144:WQYB/84cWxC1GsbMam4XspTJ755+SQ0FR38364ijCqr8pHqd5QbDMg3CVW1I:WJa1BgnRJDe0r38364iMEd5Q3E41I

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  4d9edfca0a206f8af57b7199590a4fbf_JaffaCakes118
- Size
  
  391KB
- MD5
  
  4d9edfca0a206f8af57b7199590a4fbf
- SHA1
  
  59d9f43da6262ecaad69fd942555fc91fdcd4e2f
- SHA256
  
  787153d0db8844cb0f61152232529c9c13c3bfbc052d10f69e0d9a632e0add36
- SHA512
  
  a9ab4de0d8e74e3a84eefefad598ce113ae110acaa6897e2b850974029e201003ac1755c397a233b1039c34d60d9917ff45d8417b03a9a5b7c32ffce982a80e6
- SSDEEP
  
  6144:WQYB/84cWxC1GsbMam4XspTJ755+SQ0FR38364ijCqr8pHqd5QbDMg3CVW1I:WJa1BgnRJDe0r38364iMEd5Q3E41I
Score

7^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2