94970d094c24e119e193710840fd870b129be2dd56db8e8a86dfe9149d7ecad9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f9d5a48da07864c89488d6fcac03548a_JaffaCakes118
Size

184KB
Sample

240927-gjhrca1cqe
MD5

f9d5a48da07864c89488d6fcac03548a
SHA1

f83c341f0466791ffaa3c79a8c79aff58776e311
SHA256

94970d094c24e119e193710840fd870b129be2dd56db8e8a86dfe9149d7ecad9
SHA512

63aab11729d4334dac371bcb6a1bee5778217cb7cc39bc701efdb5e81bdb7c514efa38021cdcb9504fa8689323eab8fbd23542b13e2232eaf0fe4bb3fffe6981
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3t:/7BSH8zUB+nGESaaRvoB7FJNndnw

Score

8^/10

discovery execution

Malware Config

Targets

- Target
  
  f9d5a48da07864c89488d6fcac03548a_JaffaCakes118
- Size
  
  184KB
- MD5
  
  f9d5a48da07864c89488d6fcac03548a
- SHA1
  
  f83c341f0466791ffaa3c79a8c79aff58776e311
- SHA256
  
  94970d094c24e119e193710840fd870b129be2dd56db8e8a86dfe9149d7ecad9
- SHA512
  
  63aab11729d4334dac371bcb6a1bee5778217cb7cc39bc701efdb5e81bdb7c514efa38021cdcb9504fa8689323eab8fbd23542b13e2232eaf0fe4bb3fffe6981
- SSDEEP
  
  3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3t:/7BSH8zUB+nGESaaRvoB7FJNndnw
Score

8^/10

discovery execution
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryexecution

behavioral2

discoveryexecution