fd8fe6753ef506783736bd17a02a47243a5f3bc8f7e09e043b0d2988854866c3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

19b3a354b2486f19880bd709dda9aa62_JaffaCakes118
Size

731KB
Sample

240628-lw7y8ataqh
MD5

19b3a354b2486f19880bd709dda9aa62
SHA1

7a239d02c9ff60ff13b8bf8a69179c89e2e826b6
SHA256

fd8fe6753ef506783736bd17a02a47243a5f3bc8f7e09e043b0d2988854866c3
SHA512

2ddccc10e737259e8ee4439f3b314c6dcd564c63ffd3dab2c7b7cc58153fdc83c6985bf2ee36dd312954b650719a5789c7cdfa39c952b000ffc273b6bb5c6f16
SSDEEP

12288:Jaingtd/9iCpVEZxzraxdUdpm6FmjnDgGeIttwoPR5pWZhAIRXHYnrmg:JaigD/ArravUds6wnlFttwYQRXHYrmg

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  19b3a354b2486f19880bd709dda9aa62_JaffaCakes118
- Size
  
  731KB
- MD5
  
  19b3a354b2486f19880bd709dda9aa62
- SHA1
  
  7a239d02c9ff60ff13b8bf8a69179c89e2e826b6
- SHA256
  
  fd8fe6753ef506783736bd17a02a47243a5f3bc8f7e09e043b0d2988854866c3
- SHA512
  
  2ddccc10e737259e8ee4439f3b314c6dcd564c63ffd3dab2c7b7cc58153fdc83c6985bf2ee36dd312954b650719a5789c7cdfa39c952b000ffc273b6bb5c6f16
- SSDEEP
  
  12288:Jaingtd/9iCpVEZxzraxdUdpm6FmjnDgGeIttwoPR5pWZhAIRXHYnrmg:JaigD/ArravUds6wnlFttwYQRXHYrmg
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation