044008d32b4212fe4c72a5a481dc492838bda8cd648df4e0e3a5ff14cb37910e | Triage

Sharing

General

Target

0cdcf9dbfc333ad250d68f77c7469da7_JaffaCakes118
Size

30KB
Sample

240328-w3vbtada2y
MD5

0cdcf9dbfc333ad250d68f77c7469da7
SHA1

e4a984e1908dbd7d81c046eada64d5b8de4523e5
SHA256

044008d32b4212fe4c72a5a481dc492838bda8cd648df4e0e3a5ff14cb37910e
SHA512

96a2b9250e9186752f9cf06a46c68d78c8c022b451bf6f01ed965c6f7e9435f899ff8ee1180d5e680e0c7a1622b5e4f4ca250f5f80004549397159fe06879bd7
SSDEEP

384:Y9Icz3kBWTHdGav99999999yi9wKKCMfxrZYkdzYHQ+GBgqPKmco:YRDzv99999999yiuKKCMfxrZY2+GmgCo

Score

7^/10

discovery

Malware Config

Targets

- Target
  
  0cdcf9dbfc333ad250d68f77c7469da7_JaffaCakes118
- Size
  
  30KB
- MD5
  
  0cdcf9dbfc333ad250d68f77c7469da7
- SHA1
  
  e4a984e1908dbd7d81c046eada64d5b8de4523e5
- SHA256
  
  044008d32b4212fe4c72a5a481dc492838bda8cd648df4e0e3a5ff14cb37910e
- SHA512
  
  96a2b9250e9186752f9cf06a46c68d78c8c022b451bf6f01ed965c6f7e9435f899ff8ee1180d5e680e0c7a1622b5e4f4ca250f5f80004549397159fe06879bd7
- SSDEEP
  
  384:Y9Icz3kBWTHdGav99999999yi9wKKCMfxrZYkdzYHQ+GBgqPKmco:YRDzv99999999yiuKKCMfxrZY2+GmgCo
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2