b5ae55f60a42639d298f61360cb9a8d4791f5a2304902cfc2b686864caa61d93 | Triage

Sharing

General

Target

2306678442fac6cc63c4b30f8341a303_JaffaCakes118
Size

728KB
Sample

240703-tv5fpszaqh
MD5

2306678442fac6cc63c4b30f8341a303
SHA1

ab5400be65638ccf3679e4d6135a4d014c3d0074
SHA256

b5ae55f60a42639d298f61360cb9a8d4791f5a2304902cfc2b686864caa61d93
SHA512

8df87098d03d60d54794b771a2de4cd3b4196b13c522f2dafad1d3f50276ec739a313f25ca50aa1d5ebd5db6f52df0c11297a53ed6c0280b81924d88d407d152
SSDEEP

12288:lEcF8D2K53tGcAOYYsLN2Z8bbXG/meGDgGeItoEc9GspWZhASRXHYnrmR:lEc8H5fMLN2Kb7GrGlFtov9GsqRXHYrm

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  2306678442fac6cc63c4b30f8341a303_JaffaCakes118
- Size
  
  728KB
- MD5
  
  2306678442fac6cc63c4b30f8341a303
- SHA1
  
  ab5400be65638ccf3679e4d6135a4d014c3d0074
- SHA256
  
  b5ae55f60a42639d298f61360cb9a8d4791f5a2304902cfc2b686864caa61d93
- SHA512
  
  8df87098d03d60d54794b771a2de4cd3b4196b13c522f2dafad1d3f50276ec739a313f25ca50aa1d5ebd5db6f52df0c11297a53ed6c0280b81924d88d407d152
- SSDEEP
  
  12288:lEcF8D2K53tGcAOYYsLN2Z8bbXG/meGDgGeItoEc9GspWZhASRXHYnrmR:lEc8H5fMLN2Kb7GrGlFtov9GsqRXHYrm
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation