957c92338dc62ffe2c0d6d4241cc912d749e91987f6d5fbd7c2ac6f2a4924259 | Triage

Sharing

General

Target

8e2721d905340e2bb9eb8fceb7f4eaec_JaffaCakes118
Size

17KB
Sample

240812-k5llxaydmd
MD5

8e2721d905340e2bb9eb8fceb7f4eaec
SHA1

9b852d2e6d770660d6cf4a7160095d58ab917918
SHA256

957c92338dc62ffe2c0d6d4241cc912d749e91987f6d5fbd7c2ac6f2a4924259
SHA512

18232f10af6622a5a00a21128ab38c9c9eb2cda1dab20edfea2b3524236df31c41a7aa140deb02be51916de82214dde54e42e77471c2a9d230c7b9b2f88c8346
SSDEEP

384:KFA5DopjcmZO2Zp+Nye8pqrmub8TyztsDN:K+ypjoKK8o8TyJc

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  8e2721d905340e2bb9eb8fceb7f4eaec_JaffaCakes118
- Size
  
  17KB
- MD5
  
  8e2721d905340e2bb9eb8fceb7f4eaec
- SHA1
  
  9b852d2e6d770660d6cf4a7160095d58ab917918
- SHA256
  
  957c92338dc62ffe2c0d6d4241cc912d749e91987f6d5fbd7c2ac6f2a4924259
- SHA512
  
  18232f10af6622a5a00a21128ab38c9c9eb2cda1dab20edfea2b3524236df31c41a7aa140deb02be51916de82214dde54e42e77471c2a9d230c7b9b2f88c8346
- SSDEEP
  
  384:KFA5DopjcmZO2Zp+Nye8pqrmub8TyztsDN:K+ypjoKK8o8TyJc
Score

8^/10

discovery persistence
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence