bbe0f74fca386e4bd78dd21c03f4b9f6086691318d684caca0fecb2122d28961 | Triage

Sharing

General

Target

0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118
Size

631KB
Sample

241002-bx49lsthqh
MD5

0843c2b2637d5c7f6a9e4867ef2a9ff4
SHA1

8d16bb23e21ca07a3ac2069bc3458847d0758f90
SHA256

bbe0f74fca386e4bd78dd21c03f4b9f6086691318d684caca0fecb2122d28961
SHA512

8571bcdc26eacf62c463038e7258bde1053db90ac2aea2d5e053c74b6201d370df8bcf0aa82bedf4be77d04bf53ec5c7992c2f32ab2d2c985df5ef74d17f2348
SSDEEP

12288:dZbp5e49S8/KtMJqmweBqRYmrCnBYOcOd3tmBvBO/IT3Y4rTM0Hlg:dZbnhE6KtMJqHeBqaWMuOcOptmm1eg0

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118
- Size
  
  631KB
- MD5
  
  0843c2b2637d5c7f6a9e4867ef2a9ff4
- SHA1
  
  8d16bb23e21ca07a3ac2069bc3458847d0758f90
- SHA256
  
  bbe0f74fca386e4bd78dd21c03f4b9f6086691318d684caca0fecb2122d28961
- SHA512
  
  8571bcdc26eacf62c463038e7258bde1053db90ac2aea2d5e053c74b6201d370df8bcf0aa82bedf4be77d04bf53ec5c7992c2f32ab2d2c985df5ef74d17f2348
- SSDEEP
  
  12288:dZbp5e49S8/KtMJqmweBqRYmrCnBYOcOd3tmBvBO/IT3Y4rTM0Hlg:dZbnhE6KtMJqHeBqaWMuOcOptmm1eg0
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence