c7222843a23fc031926828311c4204ba181271a1dde91017bc4695dc95b5fc46 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f57e89c724ad5c65578db7edbeb05e3a_JaffaCakes118
Size

608KB
Sample

240925-h9xtmawamd
MD5

f57e89c724ad5c65578db7edbeb05e3a
SHA1

684f922190a1943b7a41fdc027a2481313237434
SHA256

c7222843a23fc031926828311c4204ba181271a1dde91017bc4695dc95b5fc46
SHA512

73bf2c67d109e24b73fcd9a9471191d8df5a9a55cc68deb7cc30dbd97dd32059d8a0186f56ff4b1dbdd614b12948ff1f77f1b73805b755803319575dbc7fd0bc
SSDEEP

12288:XaXTluCLCAqORsac1wWdEgNrIe6BzRyIPat8MOBOKQYigKKPJ:KXxbWOBgfBIdaIPi8pO2J

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  f57e89c724ad5c65578db7edbeb05e3a_JaffaCakes118
- Size
  
  608KB
- MD5
  
  f57e89c724ad5c65578db7edbeb05e3a
- SHA1
  
  684f922190a1943b7a41fdc027a2481313237434
- SHA256
  
  c7222843a23fc031926828311c4204ba181271a1dde91017bc4695dc95b5fc46
- SHA512
  
  73bf2c67d109e24b73fcd9a9471191d8df5a9a55cc68deb7cc30dbd97dd32059d8a0186f56ff4b1dbdd614b12948ff1f77f1b73805b755803319575dbc7fd0bc
- SSDEEP
  
  12288:XaXTluCLCAqORsac1wWdEgNrIe6BzRyIPat8MOBOKQYigKKPJ:KXxbWOBgfBIdaIPi8pO2J
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence