f93d586aff872566e1c86c520454c3c1c953ce6ceb1febe3fc5e019fd7a6e779 | Triage

Sharing

General

Target

44bae672a475679dc2f67f8954cc202a_JaffaCakes118
Size

26KB
Sample

240714-hgsn7ssfmg
MD5

44bae672a475679dc2f67f8954cc202a
SHA1

bbf835ed4f8313677257ea9e95e533c13c8f4c18
SHA256

f93d586aff872566e1c86c520454c3c1c953ce6ceb1febe3fc5e019fd7a6e779
SHA512

00003ba644140363c0606a152a2ec2569726aaee8f502d65dbcd62babea66eefddc7e3a2d368364cada73b5bb13b835641a027e7cd0e0112f2a4702b8464a743
SSDEEP

768:zUhgl7eGptUg7Gd8HXVEu5TWG5vg/vOa:wUe4tH7GdQEUW4kvOa

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  44bae672a475679dc2f67f8954cc202a_JaffaCakes118
- Size
  
  26KB
- MD5
  
  44bae672a475679dc2f67f8954cc202a
- SHA1
  
  bbf835ed4f8313677257ea9e95e533c13c8f4c18
- SHA256
  
  f93d586aff872566e1c86c520454c3c1c953ce6ceb1febe3fc5e019fd7a6e779
- SHA512
  
  00003ba644140363c0606a152a2ec2569726aaee8f502d65dbcd62babea66eefddc7e3a2d368364cada73b5bb13b835641a027e7cd0e0112f2a4702b8464a743
- SSDEEP
  
  768:zUhgl7eGptUg7Gd8HXVEu5TWG5vg/vOa:wUe4tH7GdQEUW4kvOa
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation