84fd92fb3399bb5b88fab341f2b663461686886d4d9c436d4c2b17059e740d2e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2f316405266a6cca6593a5a487f98858_JaffaCakes118
Size

398KB
Sample

240709-gjrdgs1dqa
MD5

2f316405266a6cca6593a5a487f98858
SHA1

268084da0a5b5aaffc2dd99e6a8b1d8d0c34f9cd
SHA256

84fd92fb3399bb5b88fab341f2b663461686886d4d9c436d4c2b17059e740d2e
SHA512

f094cd0626b6e3cecd236ca96ab8b128df277381f5aeb60c4e8c415dcf6454c76043c86964561b6bd2a7d983ad084a6e7836306eb0913cdb25159843bd344086
SSDEEP

12288:4Kq88BMqoi70Nenqn62Cv+ANeTmrlQ0wdmg:4U8BMqoDNenq62Cv+r2uNdmg

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  2f316405266a6cca6593a5a487f98858_JaffaCakes118
- Size
  
  398KB
- MD5
  
  2f316405266a6cca6593a5a487f98858
- SHA1
  
  268084da0a5b5aaffc2dd99e6a8b1d8d0c34f9cd
- SHA256
  
  84fd92fb3399bb5b88fab341f2b663461686886d4d9c436d4c2b17059e740d2e
- SHA512
  
  f094cd0626b6e3cecd236ca96ab8b128df277381f5aeb60c4e8c415dcf6454c76043c86964561b6bd2a7d983ad084a6e7836306eb0913cdb25159843bd344086
- SSDEEP
  
  12288:4Kq88BMqoi70Nenqn62Cv+ANeTmrlQ0wdmg:4U8BMqoDNenq62Cv+r2uNdmg
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation