41ec8e38610c5f1786fc1f78bb36d81fe1243f3693a33f53f14c7ecde84c2e76 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

726c398592091f494631133e3c0d7ce9_JaffaCakes118
Size

299KB
Sample

240726-dzt8jatejr
MD5

726c398592091f494631133e3c0d7ce9
SHA1

886167cd076857504058980f370ef5f9dc39ea22
SHA256

41ec8e38610c5f1786fc1f78bb36d81fe1243f3693a33f53f14c7ecde84c2e76
SHA512

3f6115de227da1383bdd1173f18f34fbb367aea1ed01b09f54254bc8b9a1598a05a59e51dd524aa39a3f14c21b975409922128b4b4ea903e058e0e9af55f229f
SSDEEP

6144:oeFnP+xAy7wEqvtTzJiXtnQaGUwDKtyaMmYSMlpHBjhQ9PXbr5E59u:bpgZ2zJ4Q5DmclpHBNc

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  726c398592091f494631133e3c0d7ce9_JaffaCakes118
- Size
  
  299KB
- MD5
  
  726c398592091f494631133e3c0d7ce9
- SHA1
  
  886167cd076857504058980f370ef5f9dc39ea22
- SHA256
  
  41ec8e38610c5f1786fc1f78bb36d81fe1243f3693a33f53f14c7ecde84c2e76
- SHA512
  
  3f6115de227da1383bdd1173f18f34fbb367aea1ed01b09f54254bc8b9a1598a05a59e51dd524aa39a3f14c21b975409922128b4b4ea903e058e0e9af55f229f
- SSDEEP
  
  6144:oeFnP+xAy7wEqvtTzJiXtnQaGUwDKtyaMmYSMlpHBjhQ9PXbr5E59u:bpgZ2zJ4Q5DmclpHBNc
Score

8^/10

discovery persistence
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence