73d952a5cb1b621d30396c0c2d5fb99c342acffb7f4e4602b407bd01c833134b | Triage

Sharing

General

Target

368f19147f2c95c486814b79ae94d045_JaffaCakes118
Size

201KB
Sample

241011-ypvfrsvhnj
MD5

368f19147f2c95c486814b79ae94d045
SHA1

50c2e0a07928e961bf266a4d49fd749f2cd94440
SHA256

73d952a5cb1b621d30396c0c2d5fb99c342acffb7f4e4602b407bd01c833134b
SHA512

ea752a2f3a040b9f19f0b33c341433f904ebab3150797e6d277e33a6988ac649733a19f8b4910ae2def08067b04dd8979b5ee998c3c094a8b2bf7afeb3c0e9c5
SSDEEP

3072:CJDR/I7cYrrnGYtAnwRaycFyExbpjC9O20HyPoTGDAA+1gwYTxMw79Fus1+zmzm:DDRayUywUpEyPo4AA+WxH79FusUqzm

Score

10^/10

discovery evasion persistence upx

Malware Config

Targets

- Target
  
  368f19147f2c95c486814b79ae94d045_JaffaCakes118
- Size
  
  201KB
- MD5
  
  368f19147f2c95c486814b79ae94d045
- SHA1
  
  50c2e0a07928e961bf266a4d49fd749f2cd94440
- SHA256
  
  73d952a5cb1b621d30396c0c2d5fb99c342acffb7f4e4602b407bd01c833134b
- SHA512
  
  ea752a2f3a040b9f19f0b33c341433f904ebab3150797e6d277e33a6988ac649733a19f8b4910ae2def08067b04dd8979b5ee998c3c094a8b2bf7afeb3c0e9c5
- SSDEEP
  
  3072:CJDR/I7cYrrnGYtAnwRaycFyExbpjC9O20HyPoTGDAA+1gwYTxMw79Fus1+zmzm:DDRayUywUpEyPo4AA+WxH79FusUqzm
Score

10^/10

discovery evasion persistence upx
- Modifies firewall policy service
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceupx

behavioral2

discoveryevasionpersistenceupx