f29b405f8dd6985fc9f4b9da704022c29cac6a47ba95b68b3fbeb6a7d322698a | Triage

Sharing

General

Target

47ea609b62c0333a685cea2ac2fb440b_JaffaCakes118
Size

731KB
Sample

240715-dfbxvaxdrh
MD5

47ea609b62c0333a685cea2ac2fb440b
SHA1

857e793ebad24b6cf567adbdaa04b9d794d9fa2a
SHA256

f29b405f8dd6985fc9f4b9da704022c29cac6a47ba95b68b3fbeb6a7d322698a
SHA512

71670f7314a46872d1fd5babadcec7b624a81ae95b60318c6441bacf4f1bcddb0583a317fd200bf360108ff0e6bcfd06518b2e4efa9fa6e61160a51aef5d3b78
SSDEEP

12288:Jaingtd/9iCpVEZxzraxdUdpmlFmjnDgGeIttwoPR5pWZhAIRXHYnrml:JaigD/ArravUdslwnlFttwYQRXHYrml

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  47ea609b62c0333a685cea2ac2fb440b_JaffaCakes118
- Size
  
  731KB
- MD5
  
  47ea609b62c0333a685cea2ac2fb440b
- SHA1
  
  857e793ebad24b6cf567adbdaa04b9d794d9fa2a
- SHA256
  
  f29b405f8dd6985fc9f4b9da704022c29cac6a47ba95b68b3fbeb6a7d322698a
- SHA512
  
  71670f7314a46872d1fd5babadcec7b624a81ae95b60318c6441bacf4f1bcddb0583a317fd200bf360108ff0e6bcfd06518b2e4efa9fa6e61160a51aef5d3b78
- SSDEEP
  
  12288:Jaingtd/9iCpVEZxzraxdUdpmlFmjnDgGeIttwoPR5pWZhAIRXHYnrml:JaigD/ArravUdslwnlFttwYQRXHYrml
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation