41a0807c907d982c101830ff96495b367fb2aa3a96f413f4a42cda6f1965bb94 | Triage

Sharing

General

Target

bd909029ecacae1f6b66104674d11e54_JaffaCakes118
Size

150KB
Sample

240823-3h515svgpr
MD5

bd909029ecacae1f6b66104674d11e54
SHA1

55857a93812c235fcefffc957a3b3214dc064fbf
SHA256

41a0807c907d982c101830ff96495b367fb2aa3a96f413f4a42cda6f1965bb94
SHA512

f8462cba91d897651790b9244198c2dc139338c4f651ed7064a3b38d8bb654669fea6728282174e7aa470cdcca60b03873e4901b59af825cbcee3b2a6d7dd519
SSDEEP

3072:BJr4QJ4QB2xuNmraT74butfkchrl29FOBPIB9:jrTB24iUcchyIm

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  bd909029ecacae1f6b66104674d11e54_JaffaCakes118
- Size
  
  150KB
- MD5
  
  bd909029ecacae1f6b66104674d11e54
- SHA1
  
  55857a93812c235fcefffc957a3b3214dc064fbf
- SHA256
  
  41a0807c907d982c101830ff96495b367fb2aa3a96f413f4a42cda6f1965bb94
- SHA512
  
  f8462cba91d897651790b9244198c2dc139338c4f651ed7064a3b38d8bb654669fea6728282174e7aa470cdcca60b03873e4901b59af825cbcee3b2a6d7dd519
- SSDEEP
  
  3072:BJr4QJ4QB2xuNmraT74butfkchrl29FOBPIB9:jrTB24iUcchyIm
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2