497672dab60854b17467d7e01d86e5c700107b806ce6f184abf0425770d12710 | Triage

Sharing

General

Target

c8d439a18c7f9b7012c905ee33c73d27_JaffaCakes118
Size

218KB
Sample

240829-ps1yaa1hpe
MD5

c8d439a18c7f9b7012c905ee33c73d27
SHA1

cc9854482b3fd438ead81386db265b22bec849bc
SHA256

497672dab60854b17467d7e01d86e5c700107b806ce6f184abf0425770d12710
SHA512

c2dc99c5ada3ad7d72da5682fa7d85c638f3e58739cdc82ca2ea2841434a8fc738b383024e256b2332db3d3fd83e196456e81fb0fcfa1c8d599f7798da71ea02
SSDEEP

6144:ZJUvv6VR/NVTId+emMj91W2cu2MIv6VR/i:ZJEW/Dhebx1B2MIW/i

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  c8d439a18c7f9b7012c905ee33c73d27_JaffaCakes118
- Size
  
  218KB
- MD5
  
  c8d439a18c7f9b7012c905ee33c73d27
- SHA1
  
  cc9854482b3fd438ead81386db265b22bec849bc
- SHA256
  
  497672dab60854b17467d7e01d86e5c700107b806ce6f184abf0425770d12710
- SHA512
  
  c2dc99c5ada3ad7d72da5682fa7d85c638f3e58739cdc82ca2ea2841434a8fc738b383024e256b2332db3d3fd83e196456e81fb0fcfa1c8d599f7798da71ea02
- SSDEEP
  
  6144:ZJUvv6VR/NVTId+emMj91W2cu2MIv6VR/i:ZJEW/Dhebx1B2MIW/i
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence