b778d76ebfdec1f375c7c6aac0be4550446a03a774a3b53177b0b074ada053a8 | Triage

Sharing

General

Target

55dc4ae704df567fba90582a2effcc16_JaffaCakes118
Size

56KB
Sample

241018-gtlkzs1ene
MD5

55dc4ae704df567fba90582a2effcc16
SHA1

f66d7e0884c43546fb649b1eaa4f840ae77bcc95
SHA256

b778d76ebfdec1f375c7c6aac0be4550446a03a774a3b53177b0b074ada053a8
SHA512

5e1b2680151312ae90e15a4b340bbdb9b12c193997fa20d85664c7ab4d5dd68971e23e03973b7c7bb1d10da25d70ac97065febfc53545588c01e80cde367197e
SSDEEP

1536:y0/oP/QQAO8WUlr1C4VnkqpHLqSlAblvWI99lZnz:yP5AOmzyqprqZbl3Znz

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  55dc4ae704df567fba90582a2effcc16_JaffaCakes118
- Size
  
  56KB
- MD5
  
  55dc4ae704df567fba90582a2effcc16
- SHA1
  
  f66d7e0884c43546fb649b1eaa4f840ae77bcc95
- SHA256
  
  b778d76ebfdec1f375c7c6aac0be4550446a03a774a3b53177b0b074ada053a8
- SHA512
  
  5e1b2680151312ae90e15a4b340bbdb9b12c193997fa20d85664c7ab4d5dd68971e23e03973b7c7bb1d10da25d70ac97065febfc53545588c01e80cde367197e
- SSDEEP
  
  1536:y0/oP/QQAO8WUlr1C4VnkqpHLqSlAblvWI99lZnz:yP5AOmzyqprqZbl3Znz
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence