18e28502ca178f56a0dba81c3092b9853cedf35ed1c96835fbca7ab459477b0a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4c1b1de45a7bd4468d8c106e1e00048f_JaffaCakes118
Size

731KB
Sample

240716-a2cjqaxbrj
MD5

4c1b1de45a7bd4468d8c106e1e00048f
SHA1

34500a5188a6b63341dcbd6cfb184d42e6bc3f27
SHA256

18e28502ca178f56a0dba81c3092b9853cedf35ed1c96835fbca7ab459477b0a
SHA512

18722b35b789b6fa2ddfb86beafbf392c46173b33e7ee183567fbf07ffc3d4a2bbc60ea149268223dcbebfd97959b914fa93b01bb202ff06ded9a15dbf9a1030
SSDEEP

12288:Jaingtd/9iCpVEZxzraxdUdpmZFmjnDgGeIttwoPR5pWZhAIRXHYnrmw:JaigD/ArravUdsZwnlFttwYQRXHYrmw

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  4c1b1de45a7bd4468d8c106e1e00048f_JaffaCakes118
- Size
  
  731KB
- MD5
  
  4c1b1de45a7bd4468d8c106e1e00048f
- SHA1
  
  34500a5188a6b63341dcbd6cfb184d42e6bc3f27
- SHA256
  
  18e28502ca178f56a0dba81c3092b9853cedf35ed1c96835fbca7ab459477b0a
- SHA512
  
  18722b35b789b6fa2ddfb86beafbf392c46173b33e7ee183567fbf07ffc3d4a2bbc60ea149268223dcbebfd97959b914fa93b01bb202ff06ded9a15dbf9a1030
- SSDEEP
  
  12288:Jaingtd/9iCpVEZxzraxdUdpmZFmjnDgGeIttwoPR5pWZhAIRXHYnrmw:JaigD/ArravUdsZwnlFttwYQRXHYrmw
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation