23a9672354247a7a2dbd2f1379346b08b0c8ff6195c8d6f98212d332143ee5eb | Triage

Sharing

General

Target

bdcaaa0091c619d36e34106d6bb1258a_JaffaCakes118
Size

202KB
Sample

240824-cepxmszdma
MD5

bdcaaa0091c619d36e34106d6bb1258a
SHA1

fd58b06c018e78c2defac2b652498e55a88fb2bc
SHA256

23a9672354247a7a2dbd2f1379346b08b0c8ff6195c8d6f98212d332143ee5eb
SHA512

d82bf5cbd59099a9b1ee8201474ccea98b942fb3e9ce4b093b14a9ab61e005febf584864e8c38592799c6a9afc122a3de05057fabf7ba39fa064cb6bda4f871d
SSDEEP

6144:jlL1wGvn5EW/8EKegappuZH8wriQ8KSexS:BJzn5h/8EKega/u58wueo

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  bdcaaa0091c619d36e34106d6bb1258a_JaffaCakes118
- Size
  
  202KB
- MD5
  
  bdcaaa0091c619d36e34106d6bb1258a
- SHA1
  
  fd58b06c018e78c2defac2b652498e55a88fb2bc
- SHA256
  
  23a9672354247a7a2dbd2f1379346b08b0c8ff6195c8d6f98212d332143ee5eb
- SHA512
  
  d82bf5cbd59099a9b1ee8201474ccea98b942fb3e9ce4b093b14a9ab61e005febf584864e8c38592799c6a9afc122a3de05057fabf7ba39fa064cb6bda4f871d
- SSDEEP
  
  6144:jlL1wGvn5EW/8EKegappuZH8wriQ8KSexS:BJzn5h/8EKega/u58wueo
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence