01ec0148bb8be5d6fec78334ee7836d40a6ab5e3404683db61898c8879594ff7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fb3bd6075083e7293b09cda7229f9d20_JaffaCakes118
Size

121KB
Sample

240928-bnvzks1hjg
MD5

fb3bd6075083e7293b09cda7229f9d20
SHA1

36aba27e7f0e8d5d6f8bc30b1c76dd7babb4161d
SHA256

01ec0148bb8be5d6fec78334ee7836d40a6ab5e3404683db61898c8879594ff7
SHA512

c97751636703b9b76face63fd7d63fc598be5fd78d1fbc2b0384475c064fb9606814ff5f8483d83d1987fc9b39e3bc9eb51cd4bee5d13f9de8cb05f81a657898
SSDEEP

3072:eO+9PFvuaukkswYRFTJJjlP4aBLpu/3dIT050a:eLNluaNLLvThPHLpulFD

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  fb3bd6075083e7293b09cda7229f9d20_JaffaCakes118
- Size
  
  121KB
- MD5
  
  fb3bd6075083e7293b09cda7229f9d20
- SHA1
  
  36aba27e7f0e8d5d6f8bc30b1c76dd7babb4161d
- SHA256
  
  01ec0148bb8be5d6fec78334ee7836d40a6ab5e3404683db61898c8879594ff7
- SHA512
  
  c97751636703b9b76face63fd7d63fc598be5fd78d1fbc2b0384475c064fb9606814ff5f8483d83d1987fc9b39e3bc9eb51cd4bee5d13f9de8cb05f81a657898
- SSDEEP
  
  3072:eO+9PFvuaukkswYRFTJJjlP4aBLpu/3dIT050a:eLNluaNLLvThPHLpulFD
Score

8^/10

discovery persistence
- Adds policy Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence