fcc2791b908c36bdacdb47aace4c012de84582a163198b10a0faea1ec41225ff | Triage

Sharing

General

Target

8a85c274a40b5d50dba30b945242c9dd_JaffaCakes118
Size

78KB
Sample

240811-qm315avhrf
MD5

8a85c274a40b5d50dba30b945242c9dd
SHA1

7e1a98af9b4a0e0c2fbb94e51fbf6736d1f0dc31
SHA256

fcc2791b908c36bdacdb47aace4c012de84582a163198b10a0faea1ec41225ff
SHA512

58e168fd0e56ea222a268c760348c43d254e3ebce4c2f655358088dace2f3c807b45a9173b08b04ee979daebfc610c96cb290129d5ecef30a5f0e364c7548008
SSDEEP

1536:widqkub+aVgWyv3tySdvVIE2jxUnjCnd0r2/pYWWDehbfb506+ji:NdFub+Bnv3oQtXaQjAt/nueNfd06h

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  8a85c274a40b5d50dba30b945242c9dd_JaffaCakes118
- Size
  
  78KB
- MD5
  
  8a85c274a40b5d50dba30b945242c9dd
- SHA1
  
  7e1a98af9b4a0e0c2fbb94e51fbf6736d1f0dc31
- SHA256
  
  fcc2791b908c36bdacdb47aace4c012de84582a163198b10a0faea1ec41225ff
- SHA512
  
  58e168fd0e56ea222a268c760348c43d254e3ebce4c2f655358088dace2f3c807b45a9173b08b04ee979daebfc610c96cb290129d5ecef30a5f0e364c7548008
- SSDEEP
  
  1536:widqkub+aVgWyv3tySdvVIE2jxUnjCnd0r2/pYWWDehbfb506+ji:NdFub+Bnv3oQtXaQjAt/nueNfd06h
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence