9e2a733100cf0950a930b85c3846a67f18b0a51e76a61abc13c5b7597a7053a1 | Triage

Sharing

General

Target

bb370ea3fd978255c46f678901f07933_JaffaCakes118
Size

175KB
Sample

240823-lm7xvsyhmj
MD5

bb370ea3fd978255c46f678901f07933
SHA1

a2860e35b6d2aa5a38b9669b69cb66adffcd6330
SHA256

9e2a733100cf0950a930b85c3846a67f18b0a51e76a61abc13c5b7597a7053a1
SHA512

9cf74449d94864c17d2fe1555154f38c9607deaba74eac3f1e8cadc94d38e9a71afa576968173443a16f3309b732639e27427c6825cf7a65df2a2324e940e711
SSDEEP

3072:29r7km1Sihv1hfhxefD4ODtcvGia4WExhqCeiRJhPh1egYXea:bmLhvDhgbJ4GPCV3h1

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  bb370ea3fd978255c46f678901f07933_JaffaCakes118
- Size
  
  175KB
- MD5
  
  bb370ea3fd978255c46f678901f07933
- SHA1
  
  a2860e35b6d2aa5a38b9669b69cb66adffcd6330
- SHA256
  
  9e2a733100cf0950a930b85c3846a67f18b0a51e76a61abc13c5b7597a7053a1
- SHA512
  
  9cf74449d94864c17d2fe1555154f38c9607deaba74eac3f1e8cadc94d38e9a71afa576968173443a16f3309b732639e27427c6825cf7a65df2a2324e940e711
- SSDEEP
  
  3072:29r7km1Sihv1hfhxefD4ODtcvGia4WExhqCeiRJhPh1egYXea:bmLhvDhgbJ4GPCV3h1
Score

8^/10

discovery persistence
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence