cc4bf46d362b62c66b55473e18d3706f245366a4a778f496d1b326bae3899df5 | Triage

Sharing

General

Target

ed85d67ede58f6b2071aa3853839a6bd_JaffaCakes118
Size

64KB
Sample

240920-n176wsvcna
MD5

ed85d67ede58f6b2071aa3853839a6bd
SHA1

f8ca9dbb0a5b98ddf66d729ee22be01d4f7d0be4
SHA256

cc4bf46d362b62c66b55473e18d3706f245366a4a778f496d1b326bae3899df5
SHA512

15de5635014b74bfd25b3e109dc92d0c171ce9a15ed99b4a6f3a2cf963866d4c576a9fcdfa773090a90429a70ca33e5b25170767db29195f8807106bc2d52b15
SSDEEP

768:b/5inm+cd5rHemPXkqUEphjVuvios1rPr4adL0NqlJMU60+ppQ1TTGfLG:bRsvcdcQjosnvnZ6LQ1EG

Score

10^/10

discovery

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
griptoloji
Password:
741852

Targets

- Target
  
  ed85d67ede58f6b2071aa3853839a6bd_JaffaCakes118
- Size
  
  64KB
- MD5
  
  ed85d67ede58f6b2071aa3853839a6bd
- SHA1
  
  f8ca9dbb0a5b98ddf66d729ee22be01d4f7d0be4
- SHA256
  
  cc4bf46d362b62c66b55473e18d3706f245366a4a778f496d1b326bae3899df5
- SHA512
  
  15de5635014b74bfd25b3e109dc92d0c171ce9a15ed99b4a6f3a2cf963866d4c576a9fcdfa773090a90429a70ca33e5b25170767db29195f8807106bc2d52b15
- SSDEEP
  
  768:b/5inm+cd5rHemPXkqUEphjVuvios1rPr4adL0NqlJMU60+ppQ1TTGfLG:bRsvcdcQjosnvnZ6LQ1EG
Score

10^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2