42a03a01291ad18b2f57364b99fedf6ecbdf97ef25416f64556757a3fc2760f2 | Triage

Sharing

General

Target

3dadd87327e92b402f5d02952eb256cf_JaffaCakes118
Size

36KB
Sample

240712-rdzssawhjm
MD5

3dadd87327e92b402f5d02952eb256cf
SHA1

4dfc944c3cd1e1e7756b0975ce1212687848412b
SHA256

42a03a01291ad18b2f57364b99fedf6ecbdf97ef25416f64556757a3fc2760f2
SHA512

8451110acfb23cd19709a544e79e7e6d1b2207a7825cdd9d7067af01f5dd02a900275accdfe7f85daffa3bd2962a96d09b466b48d4f6acb8dc6fb969238d173f
SSDEEP

768:82gpFmvbXimSBlWRVJqYOF6dXm3jI3bOmcO:+KiYAF65m3jMcO

Score

10^/10

evasion execution persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  3dadd87327e92b402f5d02952eb256cf_JaffaCakes118
- Size
  
  36KB
- MD5
  
  3dadd87327e92b402f5d02952eb256cf
- SHA1
  
  4dfc944c3cd1e1e7756b0975ce1212687848412b
- SHA256
  
  42a03a01291ad18b2f57364b99fedf6ecbdf97ef25416f64556757a3fc2760f2
- SHA512
  
  8451110acfb23cd19709a544e79e7e6d1b2207a7825cdd9d7067af01f5dd02a900275accdfe7f85daffa3bd2962a96d09b466b48d4f6acb8dc6fb969238d173f
- SSDEEP
  
  768:82gpFmvbXimSBlWRVJqYOF6dXm3jI3bOmcO:+KiYAF65m3jMcO
Score

10^/10

evasion execution persistence privilege_escalation trojan
- Disables service(s)
  evasion execution
- Windows security bypass
  evasion trojan
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

evasionexecutionpersistenceprivilege_escalationtrojan

behavioral2

evasionexecutionpersistenceprivilege_escalationtrojan