82495c03265f8cfe3836f4cb632f5cbeef745cfb71ec30746f92a7f40bd45c27 | Triage

Sharing

General

Target

ef1583ec251e184f2596aa366e5c8d59_JaffaCakes118
Size

127KB
Sample

240921-fbh7gawajn
MD5

ef1583ec251e184f2596aa366e5c8d59
SHA1

f18bd589e7fd7e55ea0d7b4208a9f607c2716b25
SHA256

82495c03265f8cfe3836f4cb632f5cbeef745cfb71ec30746f92a7f40bd45c27
SHA512

cb43250f0efda691e9a1cee51991e27f1196ce29b48b10463696ba79ddc0938a5e32247a2bd32c32b7ef4c084745eacc771336c4b9326a374ea9ed9f678c2287
SSDEEP

3072:Lnj9ItfUjINndIc0JXJDoMNVEltfwnz1quJhDVTDHRE6:LjLei3JDoIErQhDBDHRP

Score

10^/10

discovery evasion persistence upx

Malware Config

Targets

- Target
  
  ef1583ec251e184f2596aa366e5c8d59_JaffaCakes118
- Size
  
  127KB
- MD5
  
  ef1583ec251e184f2596aa366e5c8d59
- SHA1
  
  f18bd589e7fd7e55ea0d7b4208a9f607c2716b25
- SHA256
  
  82495c03265f8cfe3836f4cb632f5cbeef745cfb71ec30746f92a7f40bd45c27
- SHA512
  
  cb43250f0efda691e9a1cee51991e27f1196ce29b48b10463696ba79ddc0938a5e32247a2bd32c32b7ef4c084745eacc771336c4b9326a374ea9ed9f678c2287
- SSDEEP
  
  3072:Lnj9ItfUjINndIc0JXJDoMNVEltfwnz1quJhDVTDHRE6:LjLei3JDoIErQhDBDHRP
Score

10^/10

discovery evasion persistence upx
- Modifies firewall policy service
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceupx

behavioral2

discoveryevasionpersistenceupx