4f84400506a99ee8b0b7d0ea00fd66d5cb575e8bf768fc6bcdbee5592e310fca | Triage

Sharing

General

Target

3e9c6a8e6988adbb16ef8715c22cdd58_JaffaCakes118
Size

20KB
Sample

240513-kkzyssef8t
MD5

3e9c6a8e6988adbb16ef8715c22cdd58
SHA1

c959d76d0cbe839ed6325796b1b92e2a62f5e5a2
SHA256

4f84400506a99ee8b0b7d0ea00fd66d5cb575e8bf768fc6bcdbee5592e310fca
SHA512

1a688465a5161ba5e49db747b07ecffd3f6d42abaa4befd3eaa02755e2bf34c90a8dcf0ecb4054a270507706cdd86b17ed6bf1763406434588fab35c11e0aeb7
SSDEEP

384:3wjKMDdC+3HjH1ciPOlHS4mLasODgZjNfqLhIdlWmpzOTkmIhkn73jbIYmYTc:3mKCDVu+msdFDdlfpzUkmRfbIh

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://wws.chasingredford.com/

Targets

- Target
  
  3e9c6a8e6988adbb16ef8715c22cdd58_JaffaCakes118
- Size
  
  20KB
- MD5
  
  3e9c6a8e6988adbb16ef8715c22cdd58
- SHA1
  
  c959d76d0cbe839ed6325796b1b92e2a62f5e5a2
- SHA256
  
  4f84400506a99ee8b0b7d0ea00fd66d5cb575e8bf768fc6bcdbee5592e310fca
- SHA512
  
  1a688465a5161ba5e49db747b07ecffd3f6d42abaa4befd3eaa02755e2bf34c90a8dcf0ecb4054a270507706cdd86b17ed6bf1763406434588fab35c11e0aeb7
- SSDEEP
  
  384:3wjKMDdC+3HjH1ciPOlHS4mLasODgZjNfqLhIdlWmpzOTkmIhkn73jbIYmYTc:3mKCDVu+msdFDdlfpzUkmRfbIh
Score

10^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2