1dc00d61c11bb37112b4f50b0fc402aabb77072de3a5f989dca5d164991e02aa | Triage

Sharing

Copy URL Twitter E-mail

General

Target

012db120d00b73334bd94d380d7208ff_JaffaCakes118
Size

107KB
Sample

240930-n22qhaxhrb
MD5

012db120d00b73334bd94d380d7208ff
SHA1

d29ffeb8f2d07d3f0ef38f80932acfa05f3ba6ed
SHA256

1dc00d61c11bb37112b4f50b0fc402aabb77072de3a5f989dca5d164991e02aa
SHA512

52c2dd4ad526bd8bf019912247967476b26701ae8697034e4b3b8fb3504f78a39e9eca15123a5092a6bc7eb38e0a953d376093dd360050c975efca438fe041a7
SSDEEP

3072:bfKuKbxKisRyuFKs/962ruc3Sf+nlJIItaR:zKuKVKisyuMPFmnPISa

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  012db120d00b73334bd94d380d7208ff_JaffaCakes118
- Size
  
  107KB
- MD5
  
  012db120d00b73334bd94d380d7208ff
- SHA1
  
  d29ffeb8f2d07d3f0ef38f80932acfa05f3ba6ed
- SHA256
  
  1dc00d61c11bb37112b4f50b0fc402aabb77072de3a5f989dca5d164991e02aa
- SHA512
  
  52c2dd4ad526bd8bf019912247967476b26701ae8697034e4b3b8fb3504f78a39e9eca15123a5092a6bc7eb38e0a953d376093dd360050c975efca438fe041a7
- SSDEEP
  
  3072:bfKuKbxKisRyuFKs/962ruc3Sf+nlJIItaR:zKuKVKisyuMPFmnPISa
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence