3305079a08cad86273d3d17f804e600fd3be62d075716bc8980a2fb6b1d83672 | Triage

Sharing

General

Target

a6ab6bb31c6a5e27323a289fab93852e_JaffaCakes118
Size

208KB
Sample

240818-n1ybpavhpr
MD5

a6ab6bb31c6a5e27323a289fab93852e
SHA1

f2528fbce91de6c9165cea27ce919b8ca51e759b
SHA256

3305079a08cad86273d3d17f804e600fd3be62d075716bc8980a2fb6b1d83672
SHA512

ee3e13de89305d0eeb78d46b14a98581782d7ce92d3f3407c568a5eb74cfe11601143ee891f04203f4176cf0843d87d120f685d413dae58e25f541bc84e18775
SSDEEP

3072:wQIA62GhyU8YyN7HBkl69GUr1GHw84ID8+FtL2qqlvq8tIrMKs4Rxpj3+l9UD:56MlN7BkYGIR8JDhFMqqlltIrNRx

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  a6ab6bb31c6a5e27323a289fab93852e_JaffaCakes118
- Size
  
  208KB
- MD5
  
  a6ab6bb31c6a5e27323a289fab93852e
- SHA1
  
  f2528fbce91de6c9165cea27ce919b8ca51e759b
- SHA256
  
  3305079a08cad86273d3d17f804e600fd3be62d075716bc8980a2fb6b1d83672
- SHA512
  
  ee3e13de89305d0eeb78d46b14a98581782d7ce92d3f3407c568a5eb74cfe11601143ee891f04203f4176cf0843d87d120f685d413dae58e25f541bc84e18775
- SSDEEP
  
  3072:wQIA62GhyU8YyN7HBkl69GUr1GHw84ID8+FtL2qqlvq8tIrMKs4Rxpj3+l9UD:56MlN7BkYGIR8JDhFMqqlltIrNRx
Score

8^/10

discovery persistence
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence