4410aecc2461c0926a7cac62ae28de9dac9b06fb3c638bf850072be0bfb71962 | Triage

Sharing

General

Target

ec1b3654cb808f2f4b36c3b9f4622772_JaffaCakes118
Size

391KB
Sample

240919-ywlgfaxhkb
MD5

ec1b3654cb808f2f4b36c3b9f4622772
SHA1

96c9e4181b6e392824b06d6a650a1ad4cd438f7c
SHA256

4410aecc2461c0926a7cac62ae28de9dac9b06fb3c638bf850072be0bfb71962
SHA512

7a655bb658b0f072dc15178dcc82c2a49ff0fa4834ee5d50a26ab65d7fbeba18f817a4e9b74a9dcd794cd8117d4b11c8ad571c2c93a16a3c20dca0a8d128b4f5
SSDEEP

12288:ux1/tk/ufkK5UcHForBSWNG8dLxJGCdjW0:u7/6uDmcHForB9hdL7x

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  ec1b3654cb808f2f4b36c3b9f4622772_JaffaCakes118
- Size
  
  391KB
- MD5
  
  ec1b3654cb808f2f4b36c3b9f4622772
- SHA1
  
  96c9e4181b6e392824b06d6a650a1ad4cd438f7c
- SHA256
  
  4410aecc2461c0926a7cac62ae28de9dac9b06fb3c638bf850072be0bfb71962
- SHA512
  
  7a655bb658b0f072dc15178dcc82c2a49ff0fa4834ee5d50a26ab65d7fbeba18f817a4e9b74a9dcd794cd8117d4b11c8ad571c2c93a16a3c20dca0a8d128b4f5
- SSDEEP
  
  12288:ux1/tk/ufkK5UcHForBSWNG8dLxJGCdjW0:u7/6uDmcHForB9hdL7x
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence