0abd1f6d34a63384a4efa1bb6d4e7349b95cecdc9f7ae125d61f98d34465cc7c | Triage

Sharing

General

Target

2349df25f70933ec4525f033b46c6fab_JaffaCakes118
Size

733KB
Sample

240703-wrg74s1epq
MD5

2349df25f70933ec4525f033b46c6fab
SHA1

3d2208f303efb3d9b24f4d585377c595a15a856a
SHA256

0abd1f6d34a63384a4efa1bb6d4e7349b95cecdc9f7ae125d61f98d34465cc7c
SHA512

e0d33e60dc67a5b1efecb0d2efaa937a9144734357c3da6e286d9f724f90a7c93c8d44cdcf8c85a7a5bae528890c9945c46117fcde7b857f06fd808d3197d124
SSDEEP

12288:13Fpj4rBRLukn+zKg2oOR2OQl5aAdmxQDgGeItGBV07XpWZhASRXHYnrmg:1VpUFRUgoOwOY5aAqQlFtWVAqRXHYrmg

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  2349df25f70933ec4525f033b46c6fab_JaffaCakes118
- Size
  
  733KB
- MD5
  
  2349df25f70933ec4525f033b46c6fab
- SHA1
  
  3d2208f303efb3d9b24f4d585377c595a15a856a
- SHA256
  
  0abd1f6d34a63384a4efa1bb6d4e7349b95cecdc9f7ae125d61f98d34465cc7c
- SHA512
  
  e0d33e60dc67a5b1efecb0d2efaa937a9144734357c3da6e286d9f724f90a7c93c8d44cdcf8c85a7a5bae528890c9945c46117fcde7b857f06fd808d3197d124
- SSDEEP
  
  12288:13Fpj4rBRLukn+zKg2oOR2OQl5aAdmxQDgGeItGBV07XpWZhASRXHYnrmg:1VpUFRUgoOwOY5aAqQlFtWVAqRXHYrmg
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation