73201834b1e50cb3d4468938b1d7e1c44098de86271cb2859aaea4741012e448 | Triage

Sharing

General

Target

ba23e051091480c533eb482ff49ebc0e_JaffaCakes118
Size

273KB
Sample

240823-drzhaavdpn
MD5

ba23e051091480c533eb482ff49ebc0e
SHA1

b82668bfee84196c5c829c8ec737c12b8c16a213
SHA256

73201834b1e50cb3d4468938b1d7e1c44098de86271cb2859aaea4741012e448
SHA512

928e40141132127663f92e5500a98245be5cf6c370110e514070aeb959a42b2e5bd4be53b0ecff7977ec298634e1e9977c6973f87efd2a0bcd9b9e70662d3b03
SSDEEP

6144:irAI/sHAeQFp9cgFa8MrVg9yGVvEF0CgckbVPyBS6ABkJyyC01:gAI/slJC9ywE0Nc0FyI6Skwh0

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  ba23e051091480c533eb482ff49ebc0e_JaffaCakes118
- Size
  
  273KB
- MD5
  
  ba23e051091480c533eb482ff49ebc0e
- SHA1
  
  b82668bfee84196c5c829c8ec737c12b8c16a213
- SHA256
  
  73201834b1e50cb3d4468938b1d7e1c44098de86271cb2859aaea4741012e448
- SHA512
  
  928e40141132127663f92e5500a98245be5cf6c370110e514070aeb959a42b2e5bd4be53b0ecff7977ec298634e1e9977c6973f87efd2a0bcd9b9e70662d3b03
- SSDEEP
  
  6144:irAI/sHAeQFp9cgFa8MrVg9yGVvEF0CgckbVPyBS6ABkJyyC01:gAI/slJC9ywE0Nc0FyI6Skwh0
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence