001d123e7a2418af6f30a1d02207d50da2e7a4abf78f863b022c85fd10ba080e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0a3a8a1133891f55499c31ddc5ba4655_JaffaCakes118
Size

182KB
Sample

241002-mlbnps1emk
MD5

0a3a8a1133891f55499c31ddc5ba4655
SHA1

d88aa9b1896fa75a7b5051e48d02af2de03091b6
SHA256

001d123e7a2418af6f30a1d02207d50da2e7a4abf78f863b022c85fd10ba080e
SHA512

5cdb1111ec341e13a41e150b2315147844209848d097590acfaa3eecd4406806abefe9c4494814386e629899aa27e2b3f984bb4702f1eba7a1689fabbc89cda5
SSDEEP

3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/k8vkgnYp:o68i3odBiTl2+TCU/Pk86

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  0a3a8a1133891f55499c31ddc5ba4655_JaffaCakes118
- Size
  
  182KB
- MD5
  
  0a3a8a1133891f55499c31ddc5ba4655
- SHA1
  
  d88aa9b1896fa75a7b5051e48d02af2de03091b6
- SHA256
  
  001d123e7a2418af6f30a1d02207d50da2e7a4abf78f863b022c85fd10ba080e
- SHA512
  
  5cdb1111ec341e13a41e150b2315147844209848d097590acfaa3eecd4406806abefe9c4494814386e629899aa27e2b3f984bb4702f1eba7a1689fabbc89cda5
- SSDEEP
  
  3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/k8vkgnYp:o68i3odBiTl2+TCU/Pk86
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence