d6da9cd08fda82f36e277fcb9d98e1a0444d1cd3a3a71c6cf262e53213f7c1e1 | Triage

Sharing

General

Target

84066d47170e1e02642690be0ca6acd4_JaffaCakes118
Size

9.1MB
Sample

240530-nbrgvagb84
MD5

84066d47170e1e02642690be0ca6acd4
SHA1

15d3b330c66c6bcf01e5b7574dc71b61ea2ca48f
SHA256

d6da9cd08fda82f36e277fcb9d98e1a0444d1cd3a3a71c6cf262e53213f7c1e1
SHA512

e386515f521cc63dd3561b260703e16cbe793315e9097e0eb23e8256dd40364da38007db1c2149ff4682d7df61c889f2de1c05821351fd8a1e87514ca70a0898
SSDEEP

196608:h0bDi3QWpZJdsYap39xyiSRQ6mUpUWiHoZyEAZ+FcAjoSZF:h0bW3QWDa0iSinUpUWiHowMcWoO

Score

8^/10

execution

Malware Config

Targets

- Target
  
  84066d47170e1e02642690be0ca6acd4_JaffaCakes118
- Size
  
  9.1MB
- MD5
  
  84066d47170e1e02642690be0ca6acd4
- SHA1
  
  15d3b330c66c6bcf01e5b7574dc71b61ea2ca48f
- SHA256
  
  d6da9cd08fda82f36e277fcb9d98e1a0444d1cd3a3a71c6cf262e53213f7c1e1
- SHA512
  
  e386515f521cc63dd3561b260703e16cbe793315e9097e0eb23e8256dd40364da38007db1c2149ff4682d7df61c889f2de1c05821351fd8a1e87514ca70a0898
- SSDEEP
  
  196608:h0bDi3QWpZJdsYap39xyiSRQ6mUpUWiHoZyEAZ+FcAjoSZF:h0bW3QWDa0iSinUpUWiHowMcWoO
Score

8^/10

execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2