20690b30c9f731f262c20e4fe4c3ae5910ca9bfa6b89458972a0e9684739fe57 | Triage

Sharing

General

Target

3d8171520d047af3f81b6c13e216b89b_JaffaCakes118
Size

728KB
Sample

240712-qdmb1svcpq
MD5

3d8171520d047af3f81b6c13e216b89b
SHA1

00a07c8a68bab5a00d2fd1aa0f63d352be8ea993
SHA256

20690b30c9f731f262c20e4fe4c3ae5910ca9bfa6b89458972a0e9684739fe57
SHA512

aefdeeea68ff83b49ad6c0be6e85d46c33c377f76ef2951b3e1970473683f01ee368cd079a985109ffac0f3afc429226b37473d51fae8aef4acf26ff0e5bb68f
SSDEEP

12288:lEcF8D2K53tGcAOYYsLN2Z8bbXH/meGDgGeItoEc9GspWZhASRXHYnrmw:lEc8H5fMLN2Kb7HrGlFtov9GsqRXHYrX

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  3d8171520d047af3f81b6c13e216b89b_JaffaCakes118
- Size
  
  728KB
- MD5
  
  3d8171520d047af3f81b6c13e216b89b
- SHA1
  
  00a07c8a68bab5a00d2fd1aa0f63d352be8ea993
- SHA256
  
  20690b30c9f731f262c20e4fe4c3ae5910ca9bfa6b89458972a0e9684739fe57
- SHA512
  
  aefdeeea68ff83b49ad6c0be6e85d46c33c377f76ef2951b3e1970473683f01ee368cd079a985109ffac0f3afc429226b37473d51fae8aef4acf26ff0e5bb68f
- SSDEEP
  
  12288:lEcF8D2K53tGcAOYYsLN2Z8bbXH/meGDgGeItoEc9GspWZhASRXHYnrmw:lEc8H5fMLN2Kb7HrGlFtov9GsqRXHYrX
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation