01b522c0189a3459677787b349dcecfad137c5dca65790243f81d3fa74c08fc8 | Triage

Sharing

General

Target

e9c3068ecc101d7ed3bcd5ce9244fa3e_JaffaCakes118
Size

400KB
Sample

240918-xf1ezsxcnf
MD5

e9c3068ecc101d7ed3bcd5ce9244fa3e
SHA1

98b98e4aa60fe06d58c093ec04904183abacda9f
SHA256

01b522c0189a3459677787b349dcecfad137c5dca65790243f81d3fa74c08fc8
SHA512

3e2f5df6e5c606773ece995528e56a3b46eda58a2acd6a4bc22ce111796384af3e92e56039331af793fad3ce437be23a7eb1a5d3d1ab2f7ea555f2184d6f8e82
SSDEEP

12288:uE4J9sOYhv3zMs+WdjhIAD2IUFuvyHJ15cR:uEQqO5s+YJu

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  e9c3068ecc101d7ed3bcd5ce9244fa3e_JaffaCakes118
- Size
  
  400KB
- MD5
  
  e9c3068ecc101d7ed3bcd5ce9244fa3e
- SHA1
  
  98b98e4aa60fe06d58c093ec04904183abacda9f
- SHA256
  
  01b522c0189a3459677787b349dcecfad137c5dca65790243f81d3fa74c08fc8
- SHA512
  
  3e2f5df6e5c606773ece995528e56a3b46eda58a2acd6a4bc22ce111796384af3e92e56039331af793fad3ce437be23a7eb1a5d3d1ab2f7ea555f2184d6f8e82
- SSDEEP
  
  12288:uE4J9sOYhv3zMs+WdjhIAD2IUFuvyHJ15cR:uEQqO5s+YJu
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence