5b4c18852c63571cab588d6967eda1bf037e7052365563cbdbd2d8eb32d059e9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a059a38a3c19deda0127b08bff7f9578_JaffaCakes118
Size

123KB
Sample

240816-3c3ntsxbrj
MD5

a059a38a3c19deda0127b08bff7f9578
SHA1

af48f747f7e9499b5c19ef139e0a6922a2cba31f
SHA256

5b4c18852c63571cab588d6967eda1bf037e7052365563cbdbd2d8eb32d059e9
SHA512

cfd49771c23d6a8ca5fde9f45038897b57d04faa816612e00b43442e88219da6e27b60a445a35890221548bb6ed1f89c6e33d1199d5e6b17175a6d474248cfde
SSDEEP

3072:JkfQbwN//jPhK8F0nnVs7xzD+JJH7sPi/Cj1xLKtzkJYkq5ukl:6ftJLJNaVNb56+Q5qt

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  a059a38a3c19deda0127b08bff7f9578_JaffaCakes118
- Size
  
  123KB
- MD5
  
  a059a38a3c19deda0127b08bff7f9578
- SHA1
  
  af48f747f7e9499b5c19ef139e0a6922a2cba31f
- SHA256
  
  5b4c18852c63571cab588d6967eda1bf037e7052365563cbdbd2d8eb32d059e9
- SHA512
  
  cfd49771c23d6a8ca5fde9f45038897b57d04faa816612e00b43442e88219da6e27b60a445a35890221548bb6ed1f89c6e33d1199d5e6b17175a6d474248cfde
- SSDEEP
  
  3072:JkfQbwN//jPhK8F0nnVs7xzD+JJH7sPi/Cj1xLKtzkJYkq5ukl:6ftJLJNaVNb56+Q5qt
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence