bcdffa892f6d70ae6bff9a37543e274553f4e82d0761da2d8f8fb2334d0743da | Triage

Sharing

Copy URL Twitter E-mail

General

Target

165f43518bc1af6d1616fe876c2335fe_JaffaCakes118
Size

728KB
Sample

240627-r2sz5swbpg
MD5

165f43518bc1af6d1616fe876c2335fe
SHA1

3bd8173d6fa3477fc05260a4a63f99751ca9b1c4
SHA256

bcdffa892f6d70ae6bff9a37543e274553f4e82d0761da2d8f8fb2334d0743da
SHA512

9b5dd6d27214d3c02ff366e59eb1b346c3410be587d0ff17e795c2951ece1dc936da31af75a2e55a3ece8d41ca31a586ebe93691aa5ab14b61edaef176634a3a
SSDEEP

12288:lEcF8D2K53tGcAOYYsLN2Z8bbXH/meGDgGeItoEc9GspWZhASRXHYnrmI:lEc8H5fMLN2Kb7HrGlFtov9GsqRXHYrz

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  165f43518bc1af6d1616fe876c2335fe_JaffaCakes118
- Size
  
  728KB
- MD5
  
  165f43518bc1af6d1616fe876c2335fe
- SHA1
  
  3bd8173d6fa3477fc05260a4a63f99751ca9b1c4
- SHA256
  
  bcdffa892f6d70ae6bff9a37543e274553f4e82d0761da2d8f8fb2334d0743da
- SHA512
  
  9b5dd6d27214d3c02ff366e59eb1b346c3410be587d0ff17e795c2951ece1dc936da31af75a2e55a3ece8d41ca31a586ebe93691aa5ab14b61edaef176634a3a
- SSDEEP
  
  12288:lEcF8D2K53tGcAOYYsLN2Z8bbXH/meGDgGeItoEc9GspWZhASRXHYnrmI:lEc8H5fMLN2Kb7HrGlFtov9GsqRXHYrz
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation