ce73e40e7daac073c631077dedccbe7188d3fa9f47cc8e5b241d933864b6f814 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4af4e5db4b37b2c641031b6bdb2cc2d9_JaffaCakes118
Size

733KB
Sample

240715-xhmlxathpk
MD5

4af4e5db4b37b2c641031b6bdb2cc2d9
SHA1

b909e0ab2f5b0c1cfaa79716d0fa8b062e58abb2
SHA256

ce73e40e7daac073c631077dedccbe7188d3fa9f47cc8e5b241d933864b6f814
SHA512

0a761cecd3f92f233346408b2095cb89b56b17495baf3bb08fee75bd4b790623cb060c12aab149ec3682479f5cad8d81653ad1813adbfbf9a3276dc09d21c14c
SSDEEP

12288:13Fpj4rBRLukn+zKg2oOR2OQl5qAdmxQDgGeItGBV07XpWZhASRXHYnrm7:1VpUFRUgoOwOY5qAqQlFtWVAqRXHYrm7

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  4af4e5db4b37b2c641031b6bdb2cc2d9_JaffaCakes118
- Size
  
  733KB
- MD5
  
  4af4e5db4b37b2c641031b6bdb2cc2d9
- SHA1
  
  b909e0ab2f5b0c1cfaa79716d0fa8b062e58abb2
- SHA256
  
  ce73e40e7daac073c631077dedccbe7188d3fa9f47cc8e5b241d933864b6f814
- SHA512
  
  0a761cecd3f92f233346408b2095cb89b56b17495baf3bb08fee75bd4b790623cb060c12aab149ec3682479f5cad8d81653ad1813adbfbf9a3276dc09d21c14c
- SSDEEP
  
  12288:13Fpj4rBRLukn+zKg2oOR2OQl5qAdmxQDgGeItGBV07XpWZhASRXHYnrm7:1VpUFRUgoOwOY5qAqQlFtWVAqRXHYrm7
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation