d19d23b390f428315e86f41e6fee503652031966caf699ac8212380309067137 | Triage

Sharing

General

Target

1430b3943e267e84a88e8da33637d086_JaffaCakes118
Size

563KB
Sample

241004-vjcf8avhnk
MD5

1430b3943e267e84a88e8da33637d086
SHA1

2786953b7c6e471df8a34c46819694bf7e647157
SHA256

d19d23b390f428315e86f41e6fee503652031966caf699ac8212380309067137
SHA512

dfd1bbc987462c3c26e5894f84462b14a6c05666702bcc02234732fc566d4bf5dad517920b0c5abeb466c937cb528670dae741bc194fd3f618d984a7fe02a0a0
SSDEEP

12288:DV+mzHLrr5ueOO+8JA39ro8Y7OiiAvCjLLGfcXh691HHfa1W2:D8AuV8JAFol7MqCjLSfcxYi1D

Score

8^/10

discovery execution persistence

Malware Config

Targets

- Target
  
  1430b3943e267e84a88e8da33637d086_JaffaCakes118
- Size
  
  563KB
- MD5
  
  1430b3943e267e84a88e8da33637d086
- SHA1
  
  2786953b7c6e471df8a34c46819694bf7e647157
- SHA256
  
  d19d23b390f428315e86f41e6fee503652031966caf699ac8212380309067137
- SHA512
  
  dfd1bbc987462c3c26e5894f84462b14a6c05666702bcc02234732fc566d4bf5dad517920b0c5abeb466c937cb528670dae741bc194fd3f618d984a7fe02a0a0
- SSDEEP
  
  12288:DV+mzHLrr5ueOO+8JA39ro8Y7OiiAvCjLLGfcXh691HHfa1W2:D8AuV8JAFol7MqCjLSfcxYi1D
Score

8^/10

discovery execution persistence
- Creates new service(s)
  persistence execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryexecutionpersistence

behavioral2

discoveryexecutionpersistence