65f53dd927a20a1551a4e2b5d7d9aab0df8146dde78e0abd2f22cbdbcd66feaf | Triage

Sharing

General

Target

04ada03e237651e65a29cc53c60fc3fd_JaffaCakes118
Size

675KB
Sample

241001-g6dqxayfqg
MD5

04ada03e237651e65a29cc53c60fc3fd
SHA1

70adacc3769cc2d4bc1df9a4070bedfb0cd57b4e
SHA256

65f53dd927a20a1551a4e2b5d7d9aab0df8146dde78e0abd2f22cbdbcd66feaf
SHA512

a5b3902963e6675e8426c2d4791a878449d958570773681120c7d8d8a1f07126eccba9d7f82c4f5e9980f11bcf621158aaf8b4acee8524f9398781bb7b52513b
SSDEEP

12288:zd3XQuje75cWCDj/iUVFWZ+eHUwRPUCWesLYJzfkjgmiiXVg6b:z9S75YnZFWZ+e0wRsCWLYFfkjg3iXJb

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  04ada03e237651e65a29cc53c60fc3fd_JaffaCakes118
- Size
  
  675KB
- MD5
  
  04ada03e237651e65a29cc53c60fc3fd
- SHA1
  
  70adacc3769cc2d4bc1df9a4070bedfb0cd57b4e
- SHA256
  
  65f53dd927a20a1551a4e2b5d7d9aab0df8146dde78e0abd2f22cbdbcd66feaf
- SHA512
  
  a5b3902963e6675e8426c2d4791a878449d958570773681120c7d8d8a1f07126eccba9d7f82c4f5e9980f11bcf621158aaf8b4acee8524f9398781bb7b52513b
- SSDEEP
  
  12288:zd3XQuje75cWCDj/iUVFWZ+eHUwRPUCWesLYJzfkjgmiiXVg6b:z9S75YnZFWZ+e0wRsCWLYFfkjg3iXJb
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence