6e3173adbf2e01d98fba49d3b1b9f366887c611ef133c51afd578b8fe7fec3e5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0f2b30f64bb8a27d519f12f505de813e_JaffaCakes118
Size

72KB
Sample

241003-rw77wazfpk
MD5

0f2b30f64bb8a27d519f12f505de813e
SHA1

45311ec9ebef1e6d7c3ae0c8a726115dc489b4b6
SHA256

6e3173adbf2e01d98fba49d3b1b9f366887c611ef133c51afd578b8fe7fec3e5
SHA512

d6f219c54bb719e5f1a7ea5141c0bb2fa3d93b8549b3217b044df9f7cf22ae4f14f64e111ab6f613b591c82607f8d39aaac3c0e186da0c28935922a1536e0521
SSDEEP

1536:+BkkSMXM98Xhlo5U9aZU1M6ELFHqHVaPIIY+q:+ekNcmhloqyWrELFHqHV+q

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  0f2b30f64bb8a27d519f12f505de813e_JaffaCakes118
- Size
  
  72KB
- MD5
  
  0f2b30f64bb8a27d519f12f505de813e
- SHA1
  
  45311ec9ebef1e6d7c3ae0c8a726115dc489b4b6
- SHA256
  
  6e3173adbf2e01d98fba49d3b1b9f366887c611ef133c51afd578b8fe7fec3e5
- SHA512
  
  d6f219c54bb719e5f1a7ea5141c0bb2fa3d93b8549b3217b044df9f7cf22ae4f14f64e111ab6f613b591c82607f8d39aaac3c0e186da0c28935922a1536e0521
- SSDEEP
  
  1536:+BkkSMXM98Xhlo5U9aZU1M6ELFHqHVaPIIY+q:+ekNcmhloqyWrELFHqHV+q
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence