2a4177aa98bafa0257423834e09e63610c9bd94ea91744d9eb5ddf15419ff8f2 | Triage

Sharing

General

Target

81c8bbc5dc675e57296b79bcc3acda1b_JaffaCakes118
Size

105KB
Sample

240801-1atxsswgqp
MD5

81c8bbc5dc675e57296b79bcc3acda1b
SHA1

a898ade3d40c959c45ce3562b501b03692776162
SHA256

2a4177aa98bafa0257423834e09e63610c9bd94ea91744d9eb5ddf15419ff8f2
SHA512

a778c41017a505074311a3b9dc1037eb025eea3597d26f9c41007049be3c05ffdf6c3fcd468a7672788053a8fc82d41dcb3da9640564f853d9920f3fb7e11dbc
SSDEEP

3072:Nt+gWOZ4xwvUFr79i+g6Sra21WnkLV0Qap7+0vl:Nt+NBrSZcnkLV0QYN

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  81c8bbc5dc675e57296b79bcc3acda1b_JaffaCakes118
- Size
  
  105KB
- MD5
  
  81c8bbc5dc675e57296b79bcc3acda1b
- SHA1
  
  a898ade3d40c959c45ce3562b501b03692776162
- SHA256
  
  2a4177aa98bafa0257423834e09e63610c9bd94ea91744d9eb5ddf15419ff8f2
- SHA512
  
  a778c41017a505074311a3b9dc1037eb025eea3597d26f9c41007049be3c05ffdf6c3fcd468a7672788053a8fc82d41dcb3da9640564f853d9920f3fb7e11dbc
- SSDEEP
  
  3072:Nt+gWOZ4xwvUFr79i+g6Sra21WnkLV0Qap7+0vl:Nt+NBrSZcnkLV0QYN
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence