90d473eb7ba024a5e712c0584ab7621738964c9e8692bb35afb765778e6ccc77 | Triage

Sharing

General

Target

ecdefc92f41ae142320e34b8de3791a8_JaffaCakes118
Size

172KB
Sample

240920-ffwy5azdrj
MD5

ecdefc92f41ae142320e34b8de3791a8
SHA1

d5e82c097e743d3973b6591a26e6d64c99755b91
SHA256

90d473eb7ba024a5e712c0584ab7621738964c9e8692bb35afb765778e6ccc77
SHA512

32aa29a76531a9f526c3d4998cf1e0cbf010e0034faac5105cbc4dff546e4cbcbe606120f85e82219563e30efc150a8469b585b1f473cd313f10eace20c045cf
SSDEEP

768:Xd4sEYFzTjEjDMqc4TXh+yI6FnalUtYTdBfsUFJlK/A3FRXGf:XRB5T4k4TE1KEUtYTdyUoAz2f

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  ecdefc92f41ae142320e34b8de3791a8_JaffaCakes118
- Size
  
  172KB
- MD5
  
  ecdefc92f41ae142320e34b8de3791a8
- SHA1
  
  d5e82c097e743d3973b6591a26e6d64c99755b91
- SHA256
  
  90d473eb7ba024a5e712c0584ab7621738964c9e8692bb35afb765778e6ccc77
- SHA512
  
  32aa29a76531a9f526c3d4998cf1e0cbf010e0034faac5105cbc4dff546e4cbcbe606120f85e82219563e30efc150a8469b585b1f473cd313f10eace20c045cf
- SSDEEP
  
  768:Xd4sEYFzTjEjDMqc4TXh+yI6FnalUtYTdBfsUFJlK/A3FRXGf:XRB5T4k4TE1KEUtYTdyUoAz2f
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence