9ea9e2bb7d0f9e3db5ceb21f226901ea9f782f291fab0e90a83f60e81abc235f | Triage

Sharing

General

Target

40d0c45a341690f87967d8092a2de38e_JaffaCakes118
Size

728KB
Sample

240713-jp628svclg
MD5

40d0c45a341690f87967d8092a2de38e
SHA1

39806f8b65db8e69502b3de6f3af9bd8793d9d4e
SHA256

9ea9e2bb7d0f9e3db5ceb21f226901ea9f782f291fab0e90a83f60e81abc235f
SHA512

bab3700824d75756db5c32f4d1447655db60046ea7f606d6c3fb44eb0c2754c9fd50b510ed3bbb98da295ddfdc8d45fffe006d6359b109f5b7dfcbdf84838c1b
SSDEEP

12288:lEcF8D2K53tGcAOYYsLN2Z8bbXM/meGDgGeItoEc9GspWZhASRXHYnrmW:lEc8H5fMLN2Kb7MrGlFtov9GsqRXHYr1

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  40d0c45a341690f87967d8092a2de38e_JaffaCakes118
- Size
  
  728KB
- MD5
  
  40d0c45a341690f87967d8092a2de38e
- SHA1
  
  39806f8b65db8e69502b3de6f3af9bd8793d9d4e
- SHA256
  
  9ea9e2bb7d0f9e3db5ceb21f226901ea9f782f291fab0e90a83f60e81abc235f
- SHA512
  
  bab3700824d75756db5c32f4d1447655db60046ea7f606d6c3fb44eb0c2754c9fd50b510ed3bbb98da295ddfdc8d45fffe006d6359b109f5b7dfcbdf84838c1b
- SSDEEP
  
  12288:lEcF8D2K53tGcAOYYsLN2Z8bbXM/meGDgGeItoEc9GspWZhASRXHYnrmW:lEc8H5fMLN2Kb7MrGlFtov9GsqRXHYr1
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation