6bede486f098902186630667977203f607dc0046af1ff3eb007104bdaa0015d8 | Triage

Sharing

General

Target

59cb2ee7fe981360d5d59f1db137fcd2_JaffaCakes118
Size

548KB
Sample

240719-a6d84sxhke
MD5

59cb2ee7fe981360d5d59f1db137fcd2
SHA1

997a93b61b532098d501bed3d102215728d7bff8
SHA256

6bede486f098902186630667977203f607dc0046af1ff3eb007104bdaa0015d8
SHA512

570cc815876b4c316dc0cb937e582715d9101a31d46fc45fc528d9a96e5f8730cc1d00511dc4c8b630753f88de878b877ccbfd6c7845b473f0350d959e6d9509
SSDEEP

6144:gQp+JNxNQl47Rdom4QRmzidNbd5jxNCpfH:gi+Xx+0ym4QR1dNb3jxABH

Score

8^/10

evasion execution persistence

Malware Config

Targets

- Target
  
  59cb2ee7fe981360d5d59f1db137fcd2_JaffaCakes118
- Size
  
  548KB
- MD5
  
  59cb2ee7fe981360d5d59f1db137fcd2
- SHA1
  
  997a93b61b532098d501bed3d102215728d7bff8
- SHA256
  
  6bede486f098902186630667977203f607dc0046af1ff3eb007104bdaa0015d8
- SHA512
  
  570cc815876b4c316dc0cb937e582715d9101a31d46fc45fc528d9a96e5f8730cc1d00511dc4c8b630753f88de878b877ccbfd6c7845b473f0350d959e6d9509
- SSDEEP
  
  6144:gQp+JNxNQl47Rdom4QRmzidNbd5jxNCpfH:gi+Xx+0ym4QR1dNb3jxABH
Score

8^/10

evasion execution persistence
- Stops running service(s)
  evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Boot or Logon Autostart Execution

Time Providers

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Time Providers

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

evasionexecutionpersistence

behavioral2