b396d430b9ad90fc54f536ae4a95ce515f24ccef2ebc506867b7dd9de7c9974f | Triage

Sharing

General

Target

3603b010e6023c7d61a7a11558cc8b29_JaffaCakes118
Size

733KB
Sample

240710-xtq4gaxdra
MD5

3603b010e6023c7d61a7a11558cc8b29
SHA1

bc1e123fb8f4585d2e6a37ffd3723c1d3f49cffa
SHA256

b396d430b9ad90fc54f536ae4a95ce515f24ccef2ebc506867b7dd9de7c9974f
SHA512

1d7971deb55cf4db1bc4e7376667204e1e7d5f722c26984750b39e1db9835d7d664f96b00191ada87130396023380ad5f7f1bb9f809236213e25614587776e7f
SSDEEP

12288:13Fpj4rBRLukn+zKg2oOR2OQl54AdmxQDgGeItGBV07XpWZhASRXHYnrmo:1VpUFRUgoOwOY54AqQlFtWVAqRXHYrmo

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  3603b010e6023c7d61a7a11558cc8b29_JaffaCakes118
- Size
  
  733KB
- MD5
  
  3603b010e6023c7d61a7a11558cc8b29
- SHA1
  
  bc1e123fb8f4585d2e6a37ffd3723c1d3f49cffa
- SHA256
  
  b396d430b9ad90fc54f536ae4a95ce515f24ccef2ebc506867b7dd9de7c9974f
- SHA512
  
  1d7971deb55cf4db1bc4e7376667204e1e7d5f722c26984750b39e1db9835d7d664f96b00191ada87130396023380ad5f7f1bb9f809236213e25614587776e7f
- SSDEEP
  
  12288:13Fpj4rBRLukn+zKg2oOR2OQl54AdmxQDgGeItGBV07XpWZhASRXHYnrmo:1VpUFRUgoOwOY54AqQlFtWVAqRXHYrmo
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation