9df49e9e2a98fca61c135b1998073458b770c9cca42b2d3f6c91dfd6ab5ccd78 | Triage

Sharing

General

Target

ea8ae6be1c3aba0a409539166924e54b_JaffaCakes118
Size

117KB
Sample

240919-eje94szdnf
MD5

ea8ae6be1c3aba0a409539166924e54b
SHA1

5dc53713e4d343a18ab6103a8383d5fb74752cfe
SHA256

9df49e9e2a98fca61c135b1998073458b770c9cca42b2d3f6c91dfd6ab5ccd78
SHA512

aff9ab4581a26a07e1ece6552d743e5d7c0e068c1525569803e7d20e6229593ff3f8276b92aa1a1fcae3f9330c96c92d2244759a8fe5e271cd143a0e6bc488d5
SSDEEP

3072:E991btnhShlotSKxbUp7Zn4PrgaiW6gjfApzohK1Rb:k1bFh86tQp7Z4Pr5ppMFEKP

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  ea8ae6be1c3aba0a409539166924e54b_JaffaCakes118
- Size
  
  117KB
- MD5
  
  ea8ae6be1c3aba0a409539166924e54b
- SHA1
  
  5dc53713e4d343a18ab6103a8383d5fb74752cfe
- SHA256
  
  9df49e9e2a98fca61c135b1998073458b770c9cca42b2d3f6c91dfd6ab5ccd78
- SHA512
  
  aff9ab4581a26a07e1ece6552d743e5d7c0e068c1525569803e7d20e6229593ff3f8276b92aa1a1fcae3f9330c96c92d2244759a8fe5e271cd143a0e6bc488d5
- SSDEEP
  
  3072:E991btnhShlotSKxbUp7Zn4PrgaiW6gjfApzohK1Rb:k1bFh86tQp7Z4Pr5ppMFEKP
Score

8^/10

discovery persistence
- Adds policy Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence