bb89b3c3fc6a0a12df16ce844c383fab12e74019113a7b9144d37eaf29c87d31 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ad2dbe582ff9b06d87ee79a3a2f3d1cc_JaffaCakes118
Size

226KB
Sample

240820-amyhmsxfnq
MD5

ad2dbe582ff9b06d87ee79a3a2f3d1cc
SHA1

af4c3298835e6474ff7b56186aa6fd1c86ebf22a
SHA256

bb89b3c3fc6a0a12df16ce844c383fab12e74019113a7b9144d37eaf29c87d31
SHA512

568a3d5c8836129f79d3de0b8fc6a5f12c46df71f0ffcdc9614ad4310c1bca0a644751ff8361e410ee6e7ad469f180e8029b483287864af0038fdea8d0bb398c
SSDEEP

3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/e8dpjBFqpjBF+:o68i3odBiTl2+TCU/J0huhuIpJ

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  ad2dbe582ff9b06d87ee79a3a2f3d1cc_JaffaCakes118
- Size
  
  226KB
- MD5
  
  ad2dbe582ff9b06d87ee79a3a2f3d1cc
- SHA1
  
  af4c3298835e6474ff7b56186aa6fd1c86ebf22a
- SHA256
  
  bb89b3c3fc6a0a12df16ce844c383fab12e74019113a7b9144d37eaf29c87d31
- SHA512
  
  568a3d5c8836129f79d3de0b8fc6a5f12c46df71f0ffcdc9614ad4310c1bca0a644751ff8361e410ee6e7ad469f180e8029b483287864af0038fdea8d0bb398c
- SSDEEP
  
  3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/e8dpjBFqpjBF+:o68i3odBiTl2+TCU/J0huhuIpJ
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence