0707469ac8883ee63cd8f6ab1ee113026b8ed9a10b7f1448c42d847feb43c1cd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

492ae834935c3bd7059094d9e218b2a8_JaffaCakes118
Size

734KB
Sample

240715-k9d3masbkb
MD5

492ae834935c3bd7059094d9e218b2a8
SHA1

0313715f8d5c6123d8738001c2e97338e35f69f9
SHA256

0707469ac8883ee63cd8f6ab1ee113026b8ed9a10b7f1448c42d847feb43c1cd
SHA512

548780a62b5b916c06ab327a27765722587ed7f1ad09d299fc0cef9e5c44347b100e4ee4da8ae7fea0e95e3c5cb9f1b64058fda439650082fa50e946e4eb0685
SSDEEP

12288:bkZMrKuT9eES2EGfKMlAvDuicrvXoKmtKDgGeIttwoPR5pWZhAIRXHYnrmhE:bkZCXTqjMWvVcLXoxKlFttwYQRXHYrmi

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  492ae834935c3bd7059094d9e218b2a8_JaffaCakes118
- Size
  
  734KB
- MD5
  
  492ae834935c3bd7059094d9e218b2a8
- SHA1
  
  0313715f8d5c6123d8738001c2e97338e35f69f9
- SHA256
  
  0707469ac8883ee63cd8f6ab1ee113026b8ed9a10b7f1448c42d847feb43c1cd
- SHA512
  
  548780a62b5b916c06ab327a27765722587ed7f1ad09d299fc0cef9e5c44347b100e4ee4da8ae7fea0e95e3c5cb9f1b64058fda439650082fa50e946e4eb0685
- SSDEEP
  
  12288:bkZMrKuT9eES2EGfKMlAvDuicrvXoKmtKDgGeIttwoPR5pWZhAIRXHYnrmhE:bkZCXTqjMWvVcLXoxKlFttwYQRXHYrmi
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation