72a82a566eb7c23d1e42f21e522a5200e0689ee2c9d56737b57b311224c57c82 | Triage

Sharing

General

Target

e0bf188e12e4a5e6fa88fa53dd25d2d2_JaffaCakes118
Size

172KB
Sample

240914-wr28aayanf
MD5

e0bf188e12e4a5e6fa88fa53dd25d2d2
SHA1

1edd4b1f4a6b81bc579c61ac4189321e56be1734
SHA256

72a82a566eb7c23d1e42f21e522a5200e0689ee2c9d56737b57b311224c57c82
SHA512

df167654d6fdbdcd900cd0f6d76cac89202045dfcfb82bc6e2c65b1799acef4c1bbd65b27483b60f5afbed6404fc11d5384cf15cfa8d665a5a0a8f5547f64cd2
SSDEEP

3072:xKBCqWyB9ORAfKdw5rXu0tVWe/ocgo1PIWckX+V1g3sWDE:xEB9O+T1PVWe/RNPIe+ris

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  e0bf188e12e4a5e6fa88fa53dd25d2d2_JaffaCakes118
- Size
  
  172KB
- MD5
  
  e0bf188e12e4a5e6fa88fa53dd25d2d2
- SHA1
  
  1edd4b1f4a6b81bc579c61ac4189321e56be1734
- SHA256
  
  72a82a566eb7c23d1e42f21e522a5200e0689ee2c9d56737b57b311224c57c82
- SHA512
  
  df167654d6fdbdcd900cd0f6d76cac89202045dfcfb82bc6e2c65b1799acef4c1bbd65b27483b60f5afbed6404fc11d5384cf15cfa8d665a5a0a8f5547f64cd2
- SSDEEP
  
  3072:xKBCqWyB9ORAfKdw5rXu0tVWe/ocgo1PIWckX+V1g3sWDE:xEB9O+T1PVWe/RNPIe+ris
Score

7^/10

discovery persistence
- Boot or Logon Autostart Execution: Print Processors
  Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Print Processors

Privilege Escalation

Boot or Logon Autostart Execution

Print Processors

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence