2b7c3a13291408c99e3efcd943986a31f7b6781fd4296194d3a7e31dd565775f | Triage

Sharing

General

Target

b1e15586b47dceb5c2b75fc92b543dd9_JaffaCakes118
Size

245KB
Sample

240821-dj115sxbpb
MD5

b1e15586b47dceb5c2b75fc92b543dd9
SHA1

638c09882ffec5acee3449637112bc1401ac4a52
SHA256

2b7c3a13291408c99e3efcd943986a31f7b6781fd4296194d3a7e31dd565775f
SHA512

54298b1c4d2ad698eb318b222513a492b5b343a777cc19d490b6647bfc0c8e7fce3271f3fba210a2079b74a01456d0144d5320220f2fd0c3568c977cac3d3a0d
SSDEEP

6144:1Nytcr+5lJOpaZ9EIyc8sJmYOYbW+tf46Ru/qvgr:1NyB5l9oIyvsJhz7Qou/+g

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  b1e15586b47dceb5c2b75fc92b543dd9_JaffaCakes118
- Size
  
  245KB
- MD5
  
  b1e15586b47dceb5c2b75fc92b543dd9
- SHA1
  
  638c09882ffec5acee3449637112bc1401ac4a52
- SHA256
  
  2b7c3a13291408c99e3efcd943986a31f7b6781fd4296194d3a7e31dd565775f
- SHA512
  
  54298b1c4d2ad698eb318b222513a492b5b343a777cc19d490b6647bfc0c8e7fce3271f3fba210a2079b74a01456d0144d5320220f2fd0c3568c977cac3d3a0d
- SSDEEP
  
  6144:1Nytcr+5lJOpaZ9EIyc8sJmYOYbW+tf46Ru/qvgr:1NyB5l9oIyvsJhz7Qou/+g
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence