59fc0039a0b621a06606ccdffbfdc8f647942bf7806ee643eb90a61f7ba99a1c | Triage

Sharing

General

Target

73a30de30bf7a7900cc2f765f73024ac_JaffaCakes118
Size

92KB
Sample

240726-mcdrps1drm
MD5

73a30de30bf7a7900cc2f765f73024ac
SHA1

ae0679feb68a23b105aca7c2b890d41f94fdd0c1
SHA256

59fc0039a0b621a06606ccdffbfdc8f647942bf7806ee643eb90a61f7ba99a1c
SHA512

a9a955011628ce4609b5193b249fc7d8ee4652db0ea597de5cc59bbc0335cff6394dec2adadab54fc5d7eb1d62da47a8d7e24f6deb5593013904f621569a4212
SSDEEP

1536:/giuHKiksDOIeAMGXGyoI9y+kpFm94msrP9UnCcyUngZuc163Xqqi9r:YnKtsDOpAMGXGyoI9kpFm94msrP9UCc8

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  73a30de30bf7a7900cc2f765f73024ac_JaffaCakes118
- Size
  
  92KB
- MD5
  
  73a30de30bf7a7900cc2f765f73024ac
- SHA1
  
  ae0679feb68a23b105aca7c2b890d41f94fdd0c1
- SHA256
  
  59fc0039a0b621a06606ccdffbfdc8f647942bf7806ee643eb90a61f7ba99a1c
- SHA512
  
  a9a955011628ce4609b5193b249fc7d8ee4652db0ea597de5cc59bbc0335cff6394dec2adadab54fc5d7eb1d62da47a8d7e24f6deb5593013904f621569a4212
- SSDEEP
  
  1536:/giuHKiksDOIeAMGXGyoI9y+kpFm94msrP9UnCcyUngZuc163Xqqi9r:YnKtsDOpAMGXGyoI9kpFm94msrP9UCc8
Score

8^/10

discovery persistence
- Adds policy Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence