32c613a617d93959e8c5dd40342cc2008f2602b7d6bbf03555321b5dc9856426 | Triage

Sharing

General

Target

36c4d396c71a5ac8a7c80dd4a36f57e9_JaffaCakes118
Size

733KB
Sample

240710-23zt7axenb
MD5

36c4d396c71a5ac8a7c80dd4a36f57e9
SHA1

5b6b8975e2a1c8f99aaf8c83f6f4689df937e05f
SHA256

32c613a617d93959e8c5dd40342cc2008f2602b7d6bbf03555321b5dc9856426
SHA512

19197cb4da3e6395d855e95d4ac8c74e8b357006e04700166a29b8e07708bc7af2e2b46422f55ddf7d0307f270e3a9d28383306548f809ee7f0ee7c9df1afd5f
SSDEEP

12288:13Fpj4rBRLukn+zKg2oOR2OQl5PAdmxQDgGeItGBV07XpWZhASRXHYnrmb:1VpUFRUgoOwOY5PAqQlFtWVAqRXHYrmb

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  36c4d396c71a5ac8a7c80dd4a36f57e9_JaffaCakes118
- Size
  
  733KB
- MD5
  
  36c4d396c71a5ac8a7c80dd4a36f57e9
- SHA1
  
  5b6b8975e2a1c8f99aaf8c83f6f4689df937e05f
- SHA256
  
  32c613a617d93959e8c5dd40342cc2008f2602b7d6bbf03555321b5dc9856426
- SHA512
  
  19197cb4da3e6395d855e95d4ac8c74e8b357006e04700166a29b8e07708bc7af2e2b46422f55ddf7d0307f270e3a9d28383306548f809ee7f0ee7c9df1afd5f
- SSDEEP
  
  12288:13Fpj4rBRLukn+zKg2oOR2OQl5PAdmxQDgGeItGBV07XpWZhASRXHYnrmb:1VpUFRUgoOwOY5PAqQlFtWVAqRXHYrmb
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation