0b25364b8e04ec24f2d03449ddf246130db8e132b12bb7f5bcc624c68b5b1a07 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8b4ac7b5fc69ae9f275abdd0fe5f7a55_JaffaCakes118
Size

122KB
Sample

240811-v2dr1atere
MD5

8b4ac7b5fc69ae9f275abdd0fe5f7a55
SHA1

1138f15258788187a7e0733dbe324abe9772ff51
SHA256

0b25364b8e04ec24f2d03449ddf246130db8e132b12bb7f5bcc624c68b5b1a07
SHA512

c4df3945387306021e5ede9a8f337cda00f99114a2e13cb598caebcdcfa184eced2f10ce67a0550d90f978f0cc619f00ea288ade5259a41a54e305041244f694
SSDEEP

3072:/uvSwwT1pWbkCbTJyaPSMhCe3Dp199E0Rl:2vNw54bkCbHPSMp3Dh9Eg

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  8b4ac7b5fc69ae9f275abdd0fe5f7a55_JaffaCakes118
- Size
  
  122KB
- MD5
  
  8b4ac7b5fc69ae9f275abdd0fe5f7a55
- SHA1
  
  1138f15258788187a7e0733dbe324abe9772ff51
- SHA256
  
  0b25364b8e04ec24f2d03449ddf246130db8e132b12bb7f5bcc624c68b5b1a07
- SHA512
  
  c4df3945387306021e5ede9a8f337cda00f99114a2e13cb598caebcdcfa184eced2f10ce67a0550d90f978f0cc619f00ea288ade5259a41a54e305041244f694
- SSDEEP
  
  3072:/uvSwwT1pWbkCbTJyaPSMhCe3Dp199E0Rl:2vNw54bkCbHPSMp3Dh9Eg
Score

8^/10

discovery persistence
- Adds policy Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence