b8cf73ced106a586e4ca15f1ea92e5d6ecf330c72e3354502ac1c32cd4a2ba90 | Triage

Sharing

General

Target

ec944292c10cc069bf2d06958a580d4f_JaffaCakes118
Size

195KB
Sample

240920-bzjqpasbkc
MD5

ec944292c10cc069bf2d06958a580d4f
SHA1

f8ff02096d5ccb83e18efb826571588eea3279e4
SHA256

b8cf73ced106a586e4ca15f1ea92e5d6ecf330c72e3354502ac1c32cd4a2ba90
SHA512

dc2b25e71bdfed1af3d67dfb6287f44395806755255abb69a12501a427120d5d5f1ff1440847a206828b9f12a78789111a59e00d5faf4edc2fbcd234babc6b8c
SSDEEP

3072:0jDsFI09hHMJiu4K5LXeeX8CPywTTyLlyTEIWSl4NISHA:0W6fvyB62Nng

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  ec944292c10cc069bf2d06958a580d4f_JaffaCakes118
- Size
  
  195KB
- MD5
  
  ec944292c10cc069bf2d06958a580d4f
- SHA1
  
  f8ff02096d5ccb83e18efb826571588eea3279e4
- SHA256
  
  b8cf73ced106a586e4ca15f1ea92e5d6ecf330c72e3354502ac1c32cd4a2ba90
- SHA512
  
  dc2b25e71bdfed1af3d67dfb6287f44395806755255abb69a12501a427120d5d5f1ff1440847a206828b9f12a78789111a59e00d5faf4edc2fbcd234babc6b8c
- SSDEEP
  
  3072:0jDsFI09hHMJiu4K5LXeeX8CPywTTyLlyTEIWSl4NISHA:0W6fvyB62Nng
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence