5a0b146a741d3d480f17d0fb88dbc1c54ccf50249589f08d758b82e1017d1b90 | Triage

Sharing

General

Target

b4ebe29f91aa6674a59d86a74bd1a6b4_JaffaCakes118
Size

236KB
Sample

241130-fszksayler
MD5

b4ebe29f91aa6674a59d86a74bd1a6b4
SHA1

dd7284838ce5b86724d288fa20b0aec1f6af50b8
SHA256

5a0b146a741d3d480f17d0fb88dbc1c54ccf50249589f08d758b82e1017d1b90
SHA512

ba07be28a17ed88600836966d3fe984eb273327e7012b591da281e3d82674773ba1b3fc5022fa5b152c7132928b713ed4cd1acb755eb3ea4760c314a8bef6bfc
SSDEEP

3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/B8HpjBFy11Awg:o68i3odBiTl2+TCU/OhuhuIpRL0

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  b4ebe29f91aa6674a59d86a74bd1a6b4_JaffaCakes118
- Size
  
  236KB
- MD5
  
  b4ebe29f91aa6674a59d86a74bd1a6b4
- SHA1
  
  dd7284838ce5b86724d288fa20b0aec1f6af50b8
- SHA256
  
  5a0b146a741d3d480f17d0fb88dbc1c54ccf50249589f08d758b82e1017d1b90
- SHA512
  
  ba07be28a17ed88600836966d3fe984eb273327e7012b591da281e3d82674773ba1b3fc5022fa5b152c7132928b713ed4cd1acb755eb3ea4760c314a8bef6bfc
- SSDEEP
  
  3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/B8HpjBFy11Awg:o68i3odBiTl2+TCU/OhuhuIpRL0
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence