ca1d43c7df11837f12a37594e204bf75d59c40af5b8d24e6944f24a20a52577e | Triage

Sharing

General

Target

49977ea91effefa69e91faaf406309c4_JaffaCakes118
Size

733KB
Sample

240715-nmsjaathlm
MD5

49977ea91effefa69e91faaf406309c4
SHA1

29fdbe1a0ee9d6c7aa9499f3a70ef9bffcea3dab
SHA256

ca1d43c7df11837f12a37594e204bf75d59c40af5b8d24e6944f24a20a52577e
SHA512

27a4edf9e8b9962e6b50c3ad6d2fb353c09053d17032973c74fe2ffa526d94f1e9090ffc0023e5c7ab2ea5775861188bbc5eaf77ad014852479d41891caa070f
SSDEEP

12288:13Fpj4rBRLukn+zKg2oOR2OQl5xAdmxQDgGeItGBV07XpWZhASRXHYnrmc:1VpUFRUgoOwOY5xAqQlFtWVAqRXHYrmc

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  49977ea91effefa69e91faaf406309c4_JaffaCakes118
- Size
  
  733KB
- MD5
  
  49977ea91effefa69e91faaf406309c4
- SHA1
  
  29fdbe1a0ee9d6c7aa9499f3a70ef9bffcea3dab
- SHA256
  
  ca1d43c7df11837f12a37594e204bf75d59c40af5b8d24e6944f24a20a52577e
- SHA512
  
  27a4edf9e8b9962e6b50c3ad6d2fb353c09053d17032973c74fe2ffa526d94f1e9090ffc0023e5c7ab2ea5775861188bbc5eaf77ad014852479d41891caa070f
- SSDEEP
  
  12288:13Fpj4rBRLukn+zKg2oOR2OQl5xAdmxQDgGeItGBV07XpWZhASRXHYnrmc:1VpUFRUgoOwOY5xAqQlFtWVAqRXHYrmc
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation