c53c441e7bc9370f144460b014b7e8ad0f8e23f4daedf425e173c45ba33dc0c1 | Triage

Sharing

General

Target

ee9922d20803a408de34257d04cf5451_JaffaCakes118
Size

219KB
Sample

240920-2zc61stblr
MD5

ee9922d20803a408de34257d04cf5451
SHA1

4d76cbc5bb6d36e6a05a25376a500870094b2640
SHA256

c53c441e7bc9370f144460b014b7e8ad0f8e23f4daedf425e173c45ba33dc0c1
SHA512

3e88bbf90709598b9c6c71e45c71e0693623584489ad033ae82307e4c653cc80ca38aecc62b0cb49a5af6ff0a8f291bc2b93bef632feea79c826844956e31dc6
SSDEEP

6144:2p4nDWgRAkPrpTntEjTF9cTcUZpi7Dgep0pIJgKgX:2UR3PwTyTZpM2pIJgKgX

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  ee9922d20803a408de34257d04cf5451_JaffaCakes118
- Size
  
  219KB
- MD5
  
  ee9922d20803a408de34257d04cf5451
- SHA1
  
  4d76cbc5bb6d36e6a05a25376a500870094b2640
- SHA256
  
  c53c441e7bc9370f144460b014b7e8ad0f8e23f4daedf425e173c45ba33dc0c1
- SHA512
  
  3e88bbf90709598b9c6c71e45c71e0693623584489ad033ae82307e4c653cc80ca38aecc62b0cb49a5af6ff0a8f291bc2b93bef632feea79c826844956e31dc6
- SSDEEP
  
  6144:2p4nDWgRAkPrpTntEjTF9cTcUZpi7Dgep0pIJgKgX:2UR3PwTyTZpM2pIJgKgX
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence