4065e7444fd522a970abdc6a763f4227515219cb1d0246564d2fe80e603f56f6 | Triage

Sharing

General

Target

d51fdbe012f6f34d9abddce7ccf81afa_JaffaCakes118
Size

16KB
Sample

240908-1e319swflj
MD5

d51fdbe012f6f34d9abddce7ccf81afa
SHA1

9db0fbd0626a1b38e899a671b32948e27df22b74
SHA256

4065e7444fd522a970abdc6a763f4227515219cb1d0246564d2fe80e603f56f6
SHA512

97c28519554131ffa37fc8295f14daa56b3cf125035c62329fe0e489a93105055cb7007a2d328857da22724ccf51ffc28ac779cbb88c4e2bd8085eb0efe0b762
SSDEEP

384:oSS9dHVLzKtkLtp1zCXay1zczYcIrNthcccLzytOXLVIpfe49ecToQXVttPXFV13:oSSzHR2t+tH2Ky1zczYcSNthcccLzyt9

Score

8^/10

execution

Malware Config

Targets

- Target
  
  d51fdbe012f6f34d9abddce7ccf81afa_JaffaCakes118
- Size
  
  16KB
- MD5
  
  d51fdbe012f6f34d9abddce7ccf81afa
- SHA1
  
  9db0fbd0626a1b38e899a671b32948e27df22b74
- SHA256
  
  4065e7444fd522a970abdc6a763f4227515219cb1d0246564d2fe80e603f56f6
- SHA512
  
  97c28519554131ffa37fc8295f14daa56b3cf125035c62329fe0e489a93105055cb7007a2d328857da22724ccf51ffc28ac779cbb88c4e2bd8085eb0efe0b762
- SSDEEP
  
  384:oSS9dHVLzKtkLtp1zCXay1zczYcIrNthcccLzytOXLVIpfe49ecToQXVttPXFV13:oSSzHR2t+tH2Ky1zczYcSNthcccLzyt9
Score

8^/10

execution
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2