1dcda095737455ece571596e221d2758cd256e8fe93f4eed3787512a0f87ac3d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3bb8ce053c0eddbdf85fc4ec661f51ee_JaffaCakes118
Size

728KB
Sample

240712-dbw28axhpd
MD5

3bb8ce053c0eddbdf85fc4ec661f51ee
SHA1

804067ae78eaca3acea7d49d2326cf7bbb31880a
SHA256

1dcda095737455ece571596e221d2758cd256e8fe93f4eed3787512a0f87ac3d
SHA512

6fcb6339a27345712336ca771f43cc546ea047aa84c4a52e14a94ed01f2643507f47f775f27f31bad601976d6cf6e35afca0761320e96722ded47159037b5ea3
SSDEEP

12288:lEcF8D2K53tGcAOYYsLN2Z8bbX8/meGDgGeItoEc9GspWZhASRXHYnrmE:lEc8H5fMLN2Kb78rGlFtov9GsqRXHYr3

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  3bb8ce053c0eddbdf85fc4ec661f51ee_JaffaCakes118
- Size
  
  728KB
- MD5
  
  3bb8ce053c0eddbdf85fc4ec661f51ee
- SHA1
  
  804067ae78eaca3acea7d49d2326cf7bbb31880a
- SHA256
  
  1dcda095737455ece571596e221d2758cd256e8fe93f4eed3787512a0f87ac3d
- SHA512
  
  6fcb6339a27345712336ca771f43cc546ea047aa84c4a52e14a94ed01f2643507f47f775f27f31bad601976d6cf6e35afca0761320e96722ded47159037b5ea3
- SSDEEP
  
  12288:lEcF8D2K53tGcAOYYsLN2Z8bbX8/meGDgGeItoEc9GspWZhASRXHYnrmE:lEc8H5fMLN2Kb78rGlFtov9GsqRXHYr3
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation