d41b91bc87058586871d021da27211e368ce2c962e62c17e5809ee8ec33edae5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8bb08a6c2b8319978eeb8fe8c72fd216_JaffaCakes118
Size

1.7MB
Sample

240811-ybgbzsvajl
MD5

8bb08a6c2b8319978eeb8fe8c72fd216
SHA1

9480b5de207af7247af5be1fa560d5e3623fa4db
SHA256

d41b91bc87058586871d021da27211e368ce2c962e62c17e5809ee8ec33edae5
SHA512

023188c3696e873fbfa301589325831cdc96160d85a8fb754f5a5eb0832dc0af8ab25fd5df0b8837e9fc5b9f9f763c5f6c1f799c2decb8cc5e713378528576ab
SSDEEP

24576:BkFteCrWqyPCuKtYR+ohN+bjjhbpstlqkE0h1hnGTKLssVNaAutlQl6X1ajUGwMt:AyP2tdoyvFbMQkbwkVNOoM1a//i9I

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  8bb08a6c2b8319978eeb8fe8c72fd216_JaffaCakes118
- Size
  
  1.7MB
- MD5
  
  8bb08a6c2b8319978eeb8fe8c72fd216
- SHA1
  
  9480b5de207af7247af5be1fa560d5e3623fa4db
- SHA256
  
  d41b91bc87058586871d021da27211e368ce2c962e62c17e5809ee8ec33edae5
- SHA512
  
  023188c3696e873fbfa301589325831cdc96160d85a8fb754f5a5eb0832dc0af8ab25fd5df0b8837e9fc5b9f9f763c5f6c1f799c2decb8cc5e713378528576ab
- SSDEEP
  
  24576:BkFteCrWqyPCuKtYR+ohN+bjjhbpstlqkE0h1hnGTKLssVNaAutlQl6X1ajUGwMt:AyP2tdoyvFbMQkbwkVNOoM1a//i9I
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoverypersistence