dac1b115a7edce7a5031b0ec0e6ee136bf624631021dec8fd222f8e8e82a7504 | Triage

Sharing

General

Target

2df4da0aca8f59e9d8c3f99f81d69543_JaffaCakes118
Size

117KB
Sample

240708-1vvptstbrf
MD5

2df4da0aca8f59e9d8c3f99f81d69543
SHA1

0e5da5876a2b37e515850ead250b26161371582b
SHA256

dac1b115a7edce7a5031b0ec0e6ee136bf624631021dec8fd222f8e8e82a7504
SHA512

8e8e441524c13a4843fd51b1585adec155ba9e728fa8a1c3a6c03db06fabd802a93b4cce05a321e313632793e1243e4e74a57e3ec2c38fccdc784999aee9b167
SSDEEP

3072:yatj024ZwnfISBtkk/1otj/MB3QoQdz6lub1Y+mbv:yCAifISBtkk/1a/MBOdz6obQbv

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  2df4da0aca8f59e9d8c3f99f81d69543_JaffaCakes118
- Size
  
  117KB
- MD5
  
  2df4da0aca8f59e9d8c3f99f81d69543
- SHA1
  
  0e5da5876a2b37e515850ead250b26161371582b
- SHA256
  
  dac1b115a7edce7a5031b0ec0e6ee136bf624631021dec8fd222f8e8e82a7504
- SHA512
  
  8e8e441524c13a4843fd51b1585adec155ba9e728fa8a1c3a6c03db06fabd802a93b4cce05a321e313632793e1243e4e74a57e3ec2c38fccdc784999aee9b167
- SSDEEP
  
  3072:yatj024ZwnfISBtkk/1otj/MB3QoQdz6lub1Y+mbv:yCAifISBtkk/1a/MBOdz6obQbv
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation