0c9a5dc47b4ff6c054a24d7451cd7818fc71bb68cd6db899b409d089cacef327 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d749f2ad17d4aa4e6de37552cdf2e055_JaffaCakes118
Size

191KB
Sample

240909-3ss5bsyblb
MD5

d749f2ad17d4aa4e6de37552cdf2e055
SHA1

fc76f01120ef1e3be07ca75b14fadbf8610210cf
SHA256

0c9a5dc47b4ff6c054a24d7451cd7818fc71bb68cd6db899b409d089cacef327
SHA512

4f6ff041dc7fdf6b4d5b2e85fa9ae392b5655d6c9110d7abd76c694a0c4208e8e39ffe765e6d920369b42718f71cbbd2686b866b412e8e5a2117865a562f70be
SSDEEP

3072:Q15IEXzbfSp15IEXzbbSJleT2P21juKcZGT6mLuO3X44uB4vyCCDgG1nUUNcsY97:QkEDbKpkEDbmHa2AutZY6mCOY4eN95C3

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  d749f2ad17d4aa4e6de37552cdf2e055_JaffaCakes118
- Size
  
  191KB
- MD5
  
  d749f2ad17d4aa4e6de37552cdf2e055
- SHA1
  
  fc76f01120ef1e3be07ca75b14fadbf8610210cf
- SHA256
  
  0c9a5dc47b4ff6c054a24d7451cd7818fc71bb68cd6db899b409d089cacef327
- SHA512
  
  4f6ff041dc7fdf6b4d5b2e85fa9ae392b5655d6c9110d7abd76c694a0c4208e8e39ffe765e6d920369b42718f71cbbd2686b866b412e8e5a2117865a562f70be
- SSDEEP
  
  3072:Q15IEXzbfSp15IEXzbbSJleT2P21juKcZGT6mLuO3X44uB4vyCCDgG1nUUNcsY97:QkEDbKpkEDbmHa2AutZY6mCOY4eN95C3
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence