e12c7388dc21f468949ba6732ff61a1065feb14d9bdb065bac6d2edeabdd6ebd | Triage

Sharing

General

Target

31fb79b693e16c36c61c25e0dd695aab_JaffaCakes118
Size

728KB
Sample

240709-zzbbbawcjr
MD5

31fb79b693e16c36c61c25e0dd695aab
SHA1

9b36944d7eb8a1aabceab4412e1c91b28fcab674
SHA256

e12c7388dc21f468949ba6732ff61a1065feb14d9bdb065bac6d2edeabdd6ebd
SHA512

2792431da5784f150ebd95d48da1445bf46dcb5b1aca9c1e666d4f4c719c6a26061b3cee48602feecfeed83887fbd53f3fb9c57455fa5389f80312fca52b63bc
SSDEEP

12288:lEcF8D2K53tGcAOYYsLN2Z8bbXA/meGDgGeItoEc9GspWZhASRXHYnrmE:lEc8H5fMLN2Kb7ArGlFtov9GsqRXHYrT

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  31fb79b693e16c36c61c25e0dd695aab_JaffaCakes118
- Size
  
  728KB
- MD5
  
  31fb79b693e16c36c61c25e0dd695aab
- SHA1
  
  9b36944d7eb8a1aabceab4412e1c91b28fcab674
- SHA256
  
  e12c7388dc21f468949ba6732ff61a1065feb14d9bdb065bac6d2edeabdd6ebd
- SHA512
  
  2792431da5784f150ebd95d48da1445bf46dcb5b1aca9c1e666d4f4c719c6a26061b3cee48602feecfeed83887fbd53f3fb9c57455fa5389f80312fca52b63bc
- SSDEEP
  
  12288:lEcF8D2K53tGcAOYYsLN2Z8bbXA/meGDgGeItoEc9GspWZhASRXHYnrmE:lEc8H5fMLN2Kb7ArGlFtov9GsqRXHYrT
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation