b12f2000d3f1dfaa1f0372ab36ac1edf7743fe879c82f9009f5821225ee4897d | Triage

Sharing

General

Target

b9a81478c33603bd3b8154ace1dec634_JaffaCakes118
Size

55KB
Sample

240823-arssyswbkg
MD5

b9a81478c33603bd3b8154ace1dec634
SHA1

3a1409a7ceca2c69fd7a356728d10817ed23245f
SHA256

b12f2000d3f1dfaa1f0372ab36ac1edf7743fe879c82f9009f5821225ee4897d
SHA512

8b7d9bae301cce42b34cdfc677934b43c6f93717b3a6770d4a07bc9d2bc7e775f1bf2cfe78e1d3b36bef05690fb35039da63312210ca24e4d96a5842fd6843b0
SSDEEP

768:Wc648rcDTCuajJ366d1S+lQFvv1YoOMNgbZpuNMrY7JsaeIwDJ8UJJk:WHuajJ366fcYoEtObeaIU

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  b9a81478c33603bd3b8154ace1dec634_JaffaCakes118
- Size
  
  55KB
- MD5
  
  b9a81478c33603bd3b8154ace1dec634
- SHA1
  
  3a1409a7ceca2c69fd7a356728d10817ed23245f
- SHA256
  
  b12f2000d3f1dfaa1f0372ab36ac1edf7743fe879c82f9009f5821225ee4897d
- SHA512
  
  8b7d9bae301cce42b34cdfc677934b43c6f93717b3a6770d4a07bc9d2bc7e775f1bf2cfe78e1d3b36bef05690fb35039da63312210ca24e4d96a5842fd6843b0
- SSDEEP
  
  768:Wc648rcDTCuajJ366d1S+lQFvv1YoOMNgbZpuNMrY7JsaeIwDJ8UJJk:WHuajJ366fcYoEtObeaIU
Score

8^/10

discovery persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2