bc6752f08b1de32ba495c40b3886b9280e736275cf74961fef1852cd5fdb8f29 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

416110c0489e2a7169dac611b397e32d_JaffaCakes118
Size

728KB
Sample

240713-mx7khszejc
MD5

416110c0489e2a7169dac611b397e32d
SHA1

8afcc72ee91a26b50cabc89f8696d4dd09da17c8
SHA256

bc6752f08b1de32ba495c40b3886b9280e736275cf74961fef1852cd5fdb8f29
SHA512

707d2262698d2d66ec8c2fc8708bf14d60b3237f11ba4ad9e525de77b8348a9eb087751df955633d1e436bef095d3bede23a90acef8655c92bbc1b63f52238bf
SSDEEP

12288:lEcF8D2K53tGcAOYYsLN2Z8bbXg/meGDgGeItoEc9GspWZhASRXHYnrmS:lEc8H5fMLN2Kb7grGlFtov9GsqRXHYrZ

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  416110c0489e2a7169dac611b397e32d_JaffaCakes118
- Size
  
  728KB
- MD5
  
  416110c0489e2a7169dac611b397e32d
- SHA1
  
  8afcc72ee91a26b50cabc89f8696d4dd09da17c8
- SHA256
  
  bc6752f08b1de32ba495c40b3886b9280e736275cf74961fef1852cd5fdb8f29
- SHA512
  
  707d2262698d2d66ec8c2fc8708bf14d60b3237f11ba4ad9e525de77b8348a9eb087751df955633d1e436bef095d3bede23a90acef8655c92bbc1b63f52238bf
- SSDEEP
  
  12288:lEcF8D2K53tGcAOYYsLN2Z8bbXg/meGDgGeItoEc9GspWZhASRXHYnrmS:lEc8H5fMLN2Kb7grGlFtov9GsqRXHYrZ
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation