eb2ee8412f6fb62b8d125a15acaa35fed1494b2efad5f2e700879d7a54885e6c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

087b3de9c38d75169fefb912c83217f7_JaffaCakes118
Size

728KB
Sample

240624-pkl46a1hpc
MD5

087b3de9c38d75169fefb912c83217f7
SHA1

e2ccf6d50dbedcb7d516cc94347fc18d52d828d2
SHA256

eb2ee8412f6fb62b8d125a15acaa35fed1494b2efad5f2e700879d7a54885e6c
SHA512

75f44f7c48147c30b6b48917f57ee540e6670cfcddb2b2a816fbc68ccaf6aba003b51bcd988c4a3fac339503f75ed8987e7403bb52de317d6ee546d8dc2e4207
SSDEEP

12288:lEcF8D2K53tGcAOYYsLN2Z8bbXO/meGDgGeItoEc9GspWZhASRXHYnrmF:lEc8H5fMLN2Kb7OrGlFtov9GsqRXHYr+

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  087b3de9c38d75169fefb912c83217f7_JaffaCakes118
- Size
  
  728KB
- MD5
  
  087b3de9c38d75169fefb912c83217f7
- SHA1
  
  e2ccf6d50dbedcb7d516cc94347fc18d52d828d2
- SHA256
  
  eb2ee8412f6fb62b8d125a15acaa35fed1494b2efad5f2e700879d7a54885e6c
- SHA512
  
  75f44f7c48147c30b6b48917f57ee540e6670cfcddb2b2a816fbc68ccaf6aba003b51bcd988c4a3fac339503f75ed8987e7403bb52de317d6ee546d8dc2e4207
- SSDEEP
  
  12288:lEcF8D2K53tGcAOYYsLN2Z8bbXO/meGDgGeItoEc9GspWZhASRXHYnrmF:lEc8H5fMLN2Kb7OrGlFtov9GsqRXHYr+
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation