e3ea21e5073c4a4480b727ed5cd4ac173f9c270c2a4edee41f660c7ab2bbe5c6 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

15479e61dcbe4a0af85f13e251af68b5_JaffaCakes118
Size

348KB
Sample

241004-3anf5asamp
MD5

15479e61dcbe4a0af85f13e251af68b5
SHA1

962625f127b539983b04c12375072156e68fe70b
SHA256

e3ea21e5073c4a4480b727ed5cd4ac173f9c270c2a4edee41f660c7ab2bbe5c6
SHA512

cfbff2614a8181a0f94c06b410b96945acbadc349c610d6e6df72e20229ce75e52c1fe24e8501798a64136774bb9fd94f81c730beb84088a227ac61abc5e5333
SSDEEP

6144:Re4dpV+upoq5/Elu+lmTDI8RB81IdebXR7m6pSsix3Vo/WI4IlsLkRfRjTfIeXCK:/dp0fk0utTUE8hlroJIOINaeXC3a

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  15479e61dcbe4a0af85f13e251af68b5_JaffaCakes118
- Size
  
  348KB
- MD5
  
  15479e61dcbe4a0af85f13e251af68b5
- SHA1
  
  962625f127b539983b04c12375072156e68fe70b
- SHA256
  
  e3ea21e5073c4a4480b727ed5cd4ac173f9c270c2a4edee41f660c7ab2bbe5c6
- SHA512
  
  cfbff2614a8181a0f94c06b410b96945acbadc349c610d6e6df72e20229ce75e52c1fe24e8501798a64136774bb9fd94f81c730beb84088a227ac61abc5e5333
- SSDEEP
  
  6144:Re4dpV+upoq5/Elu+lmTDI8RB81IdebXR7m6pSsix3Vo/WI4IlsLkRfRjTfIeXCK:/dp0fk0utTUE8hlroJIOINaeXC3a
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence