035137e72e135f25c3fad33c9061f5651b30ad61de911849918563813c93cad0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6119c88e5301f16348256e972b690325_JaffaCakes118
Size

179KB
Sample

240721-x779xatckl
MD5

6119c88e5301f16348256e972b690325
SHA1

3037576177cf73d159044804a0b55cb780dde3c3
SHA256

035137e72e135f25c3fad33c9061f5651b30ad61de911849918563813c93cad0
SHA512

9331af095aa26c91305b843331f19b8517ef7ab3529cdf828b78fcb12807a2c7f496ad35f3e108a265bd6718ee045f9b26eb14c88d6b767b7b2f45ffe230af3b
SSDEEP

3072:ImVynapWCWDe7ski+r+yblrFWg/m9uVMDPXezFhbnl+fyTO2vZlSbWbDK5mrLlrZ:GndCl7sEr+yblrF7/RVMTXQjpe2vZBDj

Score

8^/10

execution persistence

Malware Config

Targets

- Target
  
  6119c88e5301f16348256e972b690325_JaffaCakes118
- Size
  
  179KB
- MD5
  
  6119c88e5301f16348256e972b690325
- SHA1
  
  3037576177cf73d159044804a0b55cb780dde3c3
- SHA256
  
  035137e72e135f25c3fad33c9061f5651b30ad61de911849918563813c93cad0
- SHA512
  
  9331af095aa26c91305b843331f19b8517ef7ab3529cdf828b78fcb12807a2c7f496ad35f3e108a265bd6718ee045f9b26eb14c88d6b767b7b2f45ffe230af3b
- SSDEEP
  
  3072:ImVynapWCWDe7ski+r+yblrFWg/m9uVMDPXezFhbnl+fyTO2vZlSbWbDK5mrLlrZ:GndCl7sEr+yblrF7/RVMTXQjpe2vZBDj
Score

8^/10

execution persistence
- Creates new service(s)
  persistence execution
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

executionpersistence

behavioral2

executionpersistence