55fcf47ceaa2a78d958cf056aab34b6a1b49af09df8f6b20bc8d323b15ab9b76 | Triage

Sharing

General

Target

376e3e98551203f5657c23841e8c29a2_JaffaCakes118
Size

1KB
Sample

240512-bcs1vabh39
MD5

376e3e98551203f5657c23841e8c29a2
SHA1

449b01b52c547d589db8f4ba27a42e2a36c1d41e
SHA256

55fcf47ceaa2a78d958cf056aab34b6a1b49af09df8f6b20bc8d323b15ab9b76
SHA512

b48584587fdfa11ae22e46e013c09f6085d13fc9e3768d7b56d8cfaf375b22f4ea5cc2d1081a2fd426cc1ad6f43931d1123986da580f4107313cbb4a56854895

Score

8^/10

execution

Malware Config

Targets

- Target
  
  Flash_Player.lnk
- Size
  
  3KB
- MD5
  
  a591b0170684749815c8643e4e6276fc
- SHA1
  
  caf54132c73b833a654fe90e8d9842bd00fc4d85
- SHA256
  
  565836c76728f4e8e371a4cc8e35a76d24c52bb995607d63002bf893b51b5ede
- SHA512
  
  b6e3ac67762a339e1ff22e93749d944c111f536a5735fcdb496bbb3e83f1dcbe522c3a183a9ed1c6b711f096e468c12b4857bf0908272a549a9c187a384e3f42
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2