ee4f8e8909023018dada586055c4649f8f927326efa69545827858a1180bb49b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

38d9bba418d12522be7854a686882e3d_JaffaCakes118
Size

728KB
Sample

240711-m6dc2awdkh
MD5

38d9bba418d12522be7854a686882e3d
SHA1

f011c402f1c11b98e0a958037edf1aadf7c6e40b
SHA256

ee4f8e8909023018dada586055c4649f8f927326efa69545827858a1180bb49b
SHA512

b654da4cdabbae4cb9d5ed7acf3242e0bc2ffaa8faba2275b5733284f0e6d66fcf9e98d0261a66e479c64e5b14e2822203c486aa1719efe564684374f751957d
SSDEEP

12288:lEcF8D2K53tGcAOYYsLN2Z8bbXw/meGDgGeItoEc9GspWZhASRXHYnrmP:lEc8H5fMLN2Kb7wrGlFtov9GsqRXHYrg

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  38d9bba418d12522be7854a686882e3d_JaffaCakes118
- Size
  
  728KB
- MD5
  
  38d9bba418d12522be7854a686882e3d
- SHA1
  
  f011c402f1c11b98e0a958037edf1aadf7c6e40b
- SHA256
  
  ee4f8e8909023018dada586055c4649f8f927326efa69545827858a1180bb49b
- SHA512
  
  b654da4cdabbae4cb9d5ed7acf3242e0bc2ffaa8faba2275b5733284f0e6d66fcf9e98d0261a66e479c64e5b14e2822203c486aa1719efe564684374f751957d
- SSDEEP
  
  12288:lEcF8D2K53tGcAOYYsLN2Z8bbXw/meGDgGeItoEc9GspWZhASRXHYnrmP:lEc8H5fMLN2Kb7wrGlFtov9GsqRXHYrg
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation