0891a8aa1c0d3fd4a170d7fea80604d05db3f7e13c4325cc2ba6037e496d57e1 | Triage

Sharing

General

Target

30d87ead1805768771e2528bb311b8f6_JaffaCakes118
Size

731KB
Sample

240709-scmmha1cne
MD5

30d87ead1805768771e2528bb311b8f6
SHA1

e57535b78d206b3a689d976dd38905e593dfe7c5
SHA256

0891a8aa1c0d3fd4a170d7fea80604d05db3f7e13c4325cc2ba6037e496d57e1
SHA512

d5f3c20f4153686de47da22542dca9811315df640d1110a340b6c07299f0b34c2a3988f905439b403b4d7035c16e718fb47d179d67b04fb3e5473b484fd8de14
SSDEEP

12288:Jaingtd/9iCpVEZxzraxdUdpm3FmjnDgGeIttwoPR5pWZhAIRXHYnrm/:JaigD/ArravUds3wnlFttwYQRXHYrm/

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  30d87ead1805768771e2528bb311b8f6_JaffaCakes118
- Size
  
  731KB
- MD5
  
  30d87ead1805768771e2528bb311b8f6
- SHA1
  
  e57535b78d206b3a689d976dd38905e593dfe7c5
- SHA256
  
  0891a8aa1c0d3fd4a170d7fea80604d05db3f7e13c4325cc2ba6037e496d57e1
- SHA512
  
  d5f3c20f4153686de47da22542dca9811315df640d1110a340b6c07299f0b34c2a3988f905439b403b4d7035c16e718fb47d179d67b04fb3e5473b484fd8de14
- SSDEEP
  
  12288:Jaingtd/9iCpVEZxzraxdUdpm3FmjnDgGeIttwoPR5pWZhAIRXHYnrm/:JaigD/ArravUds3wnlFttwYQRXHYrm/
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation