5c6c27f098a6346690cb6f0226d793f7646e4fa54a6410a843367af1480fec27 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

891df531103348e748e94bd0df56e29f_JaffaCakes118
Size

40KB
Sample

240811-ftfjaswfjn
MD5

891df531103348e748e94bd0df56e29f
SHA1

22d4fae38b39062648141d123f2fc9e06f40fd59
SHA256

5c6c27f098a6346690cb6f0226d793f7646e4fa54a6410a843367af1480fec27
SHA512

736bde4232c879ea4da8b2ba94358b68c479d390ffb624d86e65e4e2f0fb3028e8916af4db86d9bdeb48e5b374bf07bf351c91dd2c605ad5afb0524e87b6fd84
SSDEEP

768:9n3mUslsrahPUX2eaDnWHJltjNgcS1NtaxRnyGoqwGkppHiAfZhQNpg7Kf:9nWUssSUX2eaDsrBgcSLtKRny5XfjgKS

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  891df531103348e748e94bd0df56e29f_JaffaCakes118
- Size
  
  40KB
- MD5
  
  891df531103348e748e94bd0df56e29f
- SHA1
  
  22d4fae38b39062648141d123f2fc9e06f40fd59
- SHA256
  
  5c6c27f098a6346690cb6f0226d793f7646e4fa54a6410a843367af1480fec27
- SHA512
  
  736bde4232c879ea4da8b2ba94358b68c479d390ffb624d86e65e4e2f0fb3028e8916af4db86d9bdeb48e5b374bf07bf351c91dd2c605ad5afb0524e87b6fd84
- SSDEEP
  
  768:9n3mUslsrahPUX2eaDnWHJltjNgcS1NtaxRnyGoqwGkppHiAfZhQNpg7Kf:9nWUssSUX2eaDsrBgcSLtKRny5XfjgKS
Score

8^/10

discovery persistence
- Sets service image path in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoverypersistence