c921e71ac2957c036b463d74300f380d4fc6c83b628bdf043f12415ebe8823ec | Triage

Sharing

General

Target

242d0985db34e9f2f7f56556ec890ee3_JaffaCakes118
Size

728KB
Sample

240704-by33yaygjd
MD5

242d0985db34e9f2f7f56556ec890ee3
SHA1

3b765ab6ca6efba39bba5ea6213e112d1fa886d9
SHA256

c921e71ac2957c036b463d74300f380d4fc6c83b628bdf043f12415ebe8823ec
SHA512

25bacb0dd6f4b89d85c0e719cbd5cc89bb9fa5e038fcf7ee3e0021349661045a7877df98b2518efd2a17e32c5dff934fc7e017a2e43ee6247a055ec95e7fef8f
SSDEEP

12288:z2/I3CMZC4u8YBbY5zgHWHmt8qMZmmcKDgGeItoEc9GspWZhASRXHYnrm2:z2QSmCrmgHCmKqMZkKlFtov9GsqRXHYh

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  242d0985db34e9f2f7f56556ec890ee3_JaffaCakes118
- Size
  
  728KB
- MD5
  
  242d0985db34e9f2f7f56556ec890ee3
- SHA1
  
  3b765ab6ca6efba39bba5ea6213e112d1fa886d9
- SHA256
  
  c921e71ac2957c036b463d74300f380d4fc6c83b628bdf043f12415ebe8823ec
- SHA512
  
  25bacb0dd6f4b89d85c0e719cbd5cc89bb9fa5e038fcf7ee3e0021349661045a7877df98b2518efd2a17e32c5dff934fc7e017a2e43ee6247a055ec95e7fef8f
- SSDEEP
  
  12288:z2/I3CMZC4u8YBbY5zgHWHmt8qMZmmcKDgGeItoEc9GspWZhASRXHYnrm2:z2QSmCrmgHCmKqMZkKlFtov9GsqRXHYh
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation