5e38850c7d084959ee0d62fa802a9c3fd567d7c5229beb7dc6a7eb76e33bd34a | Triage

Sharing

General

Target

8cf26505203d553b12a389b745cc56b1_JaffaCakes118
Size

115KB
Sample

240812-cwjrysvgpc
MD5

8cf26505203d553b12a389b745cc56b1
SHA1

86d99689b024fa5e00011488730322f8f33fab22
SHA256

5e38850c7d084959ee0d62fa802a9c3fd567d7c5229beb7dc6a7eb76e33bd34a
SHA512

48da22bd849cf34e3bb1b048bc7b096a781cb39b5fe0ed8234117f234e06d3d54215e3675591c2278ddf36380e494cffaa68edbf32b5d646241d1b7f82ad9b41
SSDEEP

1536:KUthJ4DCIiGIgT3DPdk9ypoSQnUJsBhNLw82aDBFtVltvHC8Yyx:KUtLFlgfPdk9ypHJqBhN0kDBFtpi8

Score

8^/10

defense_evasion discovery exploit

Malware Config

Targets

- Target
  
  8cf26505203d553b12a389b745cc56b1_JaffaCakes118
- Size
  
  115KB
- MD5
  
  8cf26505203d553b12a389b745cc56b1
- SHA1
  
  86d99689b024fa5e00011488730322f8f33fab22
- SHA256
  
  5e38850c7d084959ee0d62fa802a9c3fd567d7c5229beb7dc6a7eb76e33bd34a
- SHA512
  
  48da22bd849cf34e3bb1b048bc7b096a781cb39b5fe0ed8234117f234e06d3d54215e3675591c2278ddf36380e494cffaa68edbf32b5d646241d1b7f82ad9b41
- SSDEEP
  
  1536:KUthJ4DCIiGIgT3DPdk9ypoSQnUJsBhNLw82aDBFtVltvHC8Yyx:KUtLFlgfPdk9ypHJqBhN0kDBFtpi8
Score

8^/10

defense_evasion discovery exploit
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Modifies file permissions
  discovery
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Windows File and Directory Permissions Modification

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryexploit

behavioral2

defense_evasiondiscoveryexploit