b7bceb202f9ed86ebb0516b0f62100f74b531678f24906676c28515fe235ac15 | Triage

Sharing

General

Target

d648bf95611f90a0a182335b3dbf5808_JaffaCakes118
Size

740KB
Sample

240909-pc961szape
MD5

d648bf95611f90a0a182335b3dbf5808
SHA1

e6dfeab4c8ba31f92517b7c835bf50da337c5be3
SHA256

b7bceb202f9ed86ebb0516b0f62100f74b531678f24906676c28515fe235ac15
SHA512

d96817d5baf75854c99f6caa5d40f26953ba993227e98c21df4a079dea08e0e2b662fa32474b87dde75a847ca77dadba54e0a6cd7b98d93dfd14b4ef9e1082a8
SSDEEP

12288:ou7sOe8PiOmd6bh0aDFD5HME8Rn9PH7hClylCyUCaJbW2iy:TMdSpFctH7hClylCyUCaHiy

Score

8^/10

defense_evasion discovery persistence

Malware Config

Targets

- Target
  
  d648bf95611f90a0a182335b3dbf5808_JaffaCakes118
- Size
  
  740KB
- MD5
  
  d648bf95611f90a0a182335b3dbf5808
- SHA1
  
  e6dfeab4c8ba31f92517b7c835bf50da337c5be3
- SHA256
  
  b7bceb202f9ed86ebb0516b0f62100f74b531678f24906676c28515fe235ac15
- SHA512
  
  d96817d5baf75854c99f6caa5d40f26953ba993227e98c21df4a079dea08e0e2b662fa32474b87dde75a847ca77dadba54e0a6cd7b98d93dfd14b4ef9e1082a8
- SSDEEP
  
  12288:ou7sOe8PiOmd6bh0aDFD5HME8Rn9PH7hClylCyUCaJbW2iy:TMdSpFctH7hClylCyUCaHiy
Score

8^/10

defense_evasion discovery persistence
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Server Software Component: Terminal Services DLL
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Image File Execution Options Injection

Server Software Component

Terminal Services DLL

Privilege Escalation

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Indicator Removal

Clear Persistence

File Deletion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoverypersistence

behavioral2

defense_evasiondiscoverypersistence