356b7b1e4da3d4494cc05b1728ffd58d60bd1def9401bbeb3cd384ba6dd20056 | Triage

Sharing

General

Target

d4413445e45e33ad25139707310c3184_JaffaCakes118
Size

146KB
Sample

240908-nljjzstcll
MD5

d4413445e45e33ad25139707310c3184
SHA1

86a1419afd829dd6a9b32f9d13ee03ad9aaab9d8
SHA256

356b7b1e4da3d4494cc05b1728ffd58d60bd1def9401bbeb3cd384ba6dd20056
SHA512

ff3487c25052179854561e987b3935c81904495579079fe28a1518797d0796a4d91a6c92aed861fec9f52ab0c3c6e8c2083d088a09097fd7f2f4ff92517d36fe
SSDEEP

3072:hH8jDldwi1hRe3WNFt333byAPVbod9qYgj3HgqhUtEXy1b8eAogWqvZ:4dwit0gfbZRodshVXyV8TogdvZ

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  d4413445e45e33ad25139707310c3184_JaffaCakes118
- Size
  
  146KB
- MD5
  
  d4413445e45e33ad25139707310c3184
- SHA1
  
  86a1419afd829dd6a9b32f9d13ee03ad9aaab9d8
- SHA256
  
  356b7b1e4da3d4494cc05b1728ffd58d60bd1def9401bbeb3cd384ba6dd20056
- SHA512
  
  ff3487c25052179854561e987b3935c81904495579079fe28a1518797d0796a4d91a6c92aed861fec9f52ab0c3c6e8c2083d088a09097fd7f2f4ff92517d36fe
- SSDEEP
  
  3072:hH8jDldwi1hRe3WNFt333byAPVbod9qYgj3HgqhUtEXy1b8eAogWqvZ:4dwit0gfbZRodshVXyV8TogdvZ
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence