d026eeee313da4fa64baff436911968737930c2036a287ab552155b4b015077a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d6061cfec17a7cc2ddc29b8b9e131128_JaffaCakes118
Size

875KB
Sample

240909-k9lgps1ckq
MD5

d6061cfec17a7cc2ddc29b8b9e131128
SHA1

6926e631edc03032df6d1a471647a316c353327e
SHA256

d026eeee313da4fa64baff436911968737930c2036a287ab552155b4b015077a
SHA512

17de41a50f695ac234a687c0b283751d1c390ed6128f58a6afd49f3c4fbe38c83693742d99fe3f2f12f0956ac514c3f39912a24eeab8c6e5d9b64ebce9e6cd32
SSDEEP

6144:nsTZgJOy+G3Fk4ETz566VgRyOJ0oDxQRHC:YZeNFO5jgRdJ8C

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  d6061cfec17a7cc2ddc29b8b9e131128_JaffaCakes118
- Size
  
  875KB
- MD5
  
  d6061cfec17a7cc2ddc29b8b9e131128
- SHA1
  
  6926e631edc03032df6d1a471647a316c353327e
- SHA256
  
  d026eeee313da4fa64baff436911968737930c2036a287ab552155b4b015077a
- SHA512
  
  17de41a50f695ac234a687c0b283751d1c390ed6128f58a6afd49f3c4fbe38c83693742d99fe3f2f12f0956ac514c3f39912a24eeab8c6e5d9b64ebce9e6cd32
- SSDEEP
  
  6144:nsTZgJOy+G3Fk4ETz566VgRyOJ0oDxQRHC:YZeNFO5jgRdJ8C
Score

10^/10

discovery evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence