77ee9c4fe3739d9636b28fa6657ddee70963ba8a945b49d29105c665defea21e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0449a48ba6a0ded26f8cc69936aa91a7_JaffaCakes118
Size

102KB
Sample

241001-ejt39szakk
MD5

0449a48ba6a0ded26f8cc69936aa91a7
SHA1

83d29929ef056483c9dd80597a4c3311c28571a5
SHA256

77ee9c4fe3739d9636b28fa6657ddee70963ba8a945b49d29105c665defea21e
SHA512

d17610cb1674dff27cc3df91384a871ce574a055cd99a90db46fd86c992d368b24ed077e44938cd715ea54b2dae7b7117cefedfe21c7970ed09dfec64c0b1870
SSDEEP

3072:mzNWMKKRZYchObK91C8sV6Xmoo4L0pYC8iJk:mZuuObR8sVImcCYC5J

Score

8^/10

discovery execution persistence

Malware Config

Targets

- Target
  
  0449a48ba6a0ded26f8cc69936aa91a7_JaffaCakes118
- Size
  
  102KB
- MD5
  
  0449a48ba6a0ded26f8cc69936aa91a7
- SHA1
  
  83d29929ef056483c9dd80597a4c3311c28571a5
- SHA256
  
  77ee9c4fe3739d9636b28fa6657ddee70963ba8a945b49d29105c665defea21e
- SHA512
  
  d17610cb1674dff27cc3df91384a871ce574a055cd99a90db46fd86c992d368b24ed077e44938cd715ea54b2dae7b7117cefedfe21c7970ed09dfec64c0b1870
- SSDEEP
  
  3072:mzNWMKKRZYchObK91C8sV6Xmoo4L0pYC8iJk:mZuuObR8sVImcCYC5J
Score

8^/10

discovery execution persistence
- Creates new service(s)
  persistence execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoveryexecutionpersistence