12ea01ce147d3b43d424959fcf23b486642c7449b8646cd00c3cbf52938a7342 | Triage

Sharing

General

Target

89772395aa928df51294bfc6677c40a3_JaffaCakes118
Size

391KB
Sample

240811-h1za4atgkc
MD5

89772395aa928df51294bfc6677c40a3
SHA1

0ce32f7154e23dd42884fdbad20d806c5ae805f4
SHA256

12ea01ce147d3b43d424959fcf23b486642c7449b8646cd00c3cbf52938a7342
SHA512

79b36e0dad6fdff3b57b9aa4b469b7df2b9ce8dc3c4d34ae77378f638d7cae85f8ea05731967a36d75f5dcf565f5fb575e4f2fa0a36321eae2fa4e36ba19e716
SSDEEP

12288:ue5/Qk/ufkK5UcHYc8Y5cLKLopYW9zOt11S5q:uY/NuDmcHY5Y5CKLoiG+j

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  89772395aa928df51294bfc6677c40a3_JaffaCakes118
- Size
  
  391KB
- MD5
  
  89772395aa928df51294bfc6677c40a3
- SHA1
  
  0ce32f7154e23dd42884fdbad20d806c5ae805f4
- SHA256
  
  12ea01ce147d3b43d424959fcf23b486642c7449b8646cd00c3cbf52938a7342
- SHA512
  
  79b36e0dad6fdff3b57b9aa4b469b7df2b9ce8dc3c4d34ae77378f638d7cae85f8ea05731967a36d75f5dcf565f5fb575e4f2fa0a36321eae2fa4e36ba19e716
- SSDEEP
  
  12288:ue5/Qk/ufkK5UcHYc8Y5cLKLopYW9zOt11S5q:uY/NuDmcHY5Y5CKLoiG+j
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence