aa4d81e7a9b2d05d4a862037881388086e1dbf925c293b04505998ae4f629e78 | Triage

Sharing

General

Target

167e1a7d36d2d6957364b5d150cf89f6_JaffaCakes118
Size

733KB
Sample

240627-sp6k5sxcrb
MD5

167e1a7d36d2d6957364b5d150cf89f6
SHA1

43e4ae00543f898d16a48abfb95b72778097ce99
SHA256

aa4d81e7a9b2d05d4a862037881388086e1dbf925c293b04505998ae4f629e78
SHA512

056a153c09a1aaf729925157b6a17d871df8a5797f9c91a407e39c5832ac476cfc4ee9e641f1fcc0f32769b08820fd3c6d2aad093160b6c5928aff0b48a0b750
SSDEEP

12288:13Fpj4rBRLukn+zKg2oOR2OQl5vAdmxQDgGeItGBV07XpWZhASRXHYnrm0:1VpUFRUgoOwOY5vAqQlFtWVAqRXHYrm0

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  167e1a7d36d2d6957364b5d150cf89f6_JaffaCakes118
- Size
  
  733KB
- MD5
  
  167e1a7d36d2d6957364b5d150cf89f6
- SHA1
  
  43e4ae00543f898d16a48abfb95b72778097ce99
- SHA256
  
  aa4d81e7a9b2d05d4a862037881388086e1dbf925c293b04505998ae4f629e78
- SHA512
  
  056a153c09a1aaf729925157b6a17d871df8a5797f9c91a407e39c5832ac476cfc4ee9e641f1fcc0f32769b08820fd3c6d2aad093160b6c5928aff0b48a0b750
- SSDEEP
  
  12288:13Fpj4rBRLukn+zKg2oOR2OQl5vAdmxQDgGeItGBV07XpWZhASRXHYnrm0:1VpUFRUgoOwOY5vAqQlFtWVAqRXHYrm0
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation