f3a44b20e917386061d5069866306f9e2bde299c22138b9b6742fb14d7714540 | Triage

Sharing

General

Target

0fa0bfca273bf9bda2ae1d27513a6a59_JaffaCakes118
Size

39KB
Sample

240625-1jb4caxelm
MD5

0fa0bfca273bf9bda2ae1d27513a6a59
SHA1

602d3c0fb0a10601fe789565ea426abcea14784b
SHA256

f3a44b20e917386061d5069866306f9e2bde299c22138b9b6742fb14d7714540
SHA512

e83a897f5c842914e3db6350de529c1fec4f52122c6a0b3af2eb6172c163b4fa924611ed549ca23ef10f43c258a293838dc71bf38502a899e8bf8a131b54980d
SSDEEP

768:mBS+UJIHhE/u9ZNDZZXcckeL4OV1d1e14Tj6yd3jUi8K2:mtFhYa/NuS4enTjtN8

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  0fa0bfca273bf9bda2ae1d27513a6a59_JaffaCakes118
- Size
  
  39KB
- MD5
  
  0fa0bfca273bf9bda2ae1d27513a6a59
- SHA1
  
  602d3c0fb0a10601fe789565ea426abcea14784b
- SHA256
  
  f3a44b20e917386061d5069866306f9e2bde299c22138b9b6742fb14d7714540
- SHA512
  
  e83a897f5c842914e3db6350de529c1fec4f52122c6a0b3af2eb6172c163b4fa924611ed549ca23ef10f43c258a293838dc71bf38502a899e8bf8a131b54980d
- SSDEEP
  
  768:mBS+UJIHhE/u9ZNDZZXcckeL4OV1d1e14Tj6yd3jUi8K2:mtFhYa/NuS4enTjtN8
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

evasionpersistenceprivilege_escalation