ab031033ff547dc011bfc7d546b80f191fdecf129055150edc275e8096f7fc7d | Triage

Sharing

General

Target

a1ad4859b42b856da51d8f6f07e7b580_JaffaCakes118
Size

88KB
Sample

240817-jckcpsxejq
MD5

a1ad4859b42b856da51d8f6f07e7b580
SHA1

1a3909c01710419ec01382448118a2c349d3d9a5
SHA256

ab031033ff547dc011bfc7d546b80f191fdecf129055150edc275e8096f7fc7d
SHA512

136b5aeae7b09963c12bedee03095d2f0fccf028937c1676168d04d10eae140fdfc8718396f70a242110b7f3bfb7c3f86a5952d6681d8c76d8b724680ee1cc96
SSDEEP

1536:YD3ws2E+U3qariRmf6TSA4d5QInIuA4d9i/rQhC8n5J9aTkFeWa7XiqR:dsL+UiNG95QEIuA4d9ajWag8

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  a1ad4859b42b856da51d8f6f07e7b580_JaffaCakes118
- Size
  
  88KB
- MD5
  
  a1ad4859b42b856da51d8f6f07e7b580
- SHA1
  
  1a3909c01710419ec01382448118a2c349d3d9a5
- SHA256
  
  ab031033ff547dc011bfc7d546b80f191fdecf129055150edc275e8096f7fc7d
- SHA512
  
  136b5aeae7b09963c12bedee03095d2f0fccf028937c1676168d04d10eae140fdfc8718396f70a242110b7f3bfb7c3f86a5952d6681d8c76d8b724680ee1cc96
- SSDEEP
  
  1536:YD3ws2E+U3qariRmf6TSA4d5QInIuA4d9i/rQhC8n5J9aTkFeWa7XiqR:dsL+UiNG95QEIuA4d9ajWag8
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence