43695ae4b6478c8fc71dc89889eea2b9dc7515dc1358c15b4f13696b963ad5bf | Triage

Sharing

General

Target

ea793640b455b7ac935531a0ecc70578_JaffaCakes118
Size

17KB
Sample

240919-dns64ayanj
MD5

ea793640b455b7ac935531a0ecc70578
SHA1

e5ed79d582ecdaf858ab02d0b2a6e74e171ba952
SHA256

43695ae4b6478c8fc71dc89889eea2b9dc7515dc1358c15b4f13696b963ad5bf
SHA512

92929e353e7eede5b8e53c21b224bb6b34d75d2722de09ee0991ae1e9be219fcb46c26c2e458ad79c42dc7f8cb7a4e58f2428fc9471e4a1d7c9c23e821280d3b
SSDEEP

384:CFYGylHccmZO2Zp+Nye8pqrmub8TyztsDN:C+PHcoKK8o8TyJc

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  ea793640b455b7ac935531a0ecc70578_JaffaCakes118
- Size
  
  17KB
- MD5
  
  ea793640b455b7ac935531a0ecc70578
- SHA1
  
  e5ed79d582ecdaf858ab02d0b2a6e74e171ba952
- SHA256
  
  43695ae4b6478c8fc71dc89889eea2b9dc7515dc1358c15b4f13696b963ad5bf
- SHA512
  
  92929e353e7eede5b8e53c21b224bb6b34d75d2722de09ee0991ae1e9be219fcb46c26c2e458ad79c42dc7f8cb7a4e58f2428fc9471e4a1d7c9c23e821280d3b
- SSDEEP
  
  384:CFYGylHccmZO2Zp+Nye8pqrmub8TyztsDN:C+PHcoKK8o8TyJc
Score

8^/10

discovery persistence
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence