294cc6678f78226cd14a549636a9dfe893ef2e1284af3cc7c38cd45cf0c7791f | Triage

Sharing

General

Target

4d748536cef3a7166b961c5fd253db48_JaffaCakes118
Size

728KB
Sample

240716-jyfxeavgpf
MD5

4d748536cef3a7166b961c5fd253db48
SHA1

6d898b4b173f3948c4e7501c29415e4ffe02e88c
SHA256

294cc6678f78226cd14a549636a9dfe893ef2e1284af3cc7c38cd45cf0c7791f
SHA512

19a49ee1d6d46f632d50be425e8f3ff0189860b5f9fb735e7054deacd405803c26bcbd09eb126a10fce0d4706991c2ff0b1c7dba8349b53430b87f38416a516b
SSDEEP

12288:lEcF8D2K53tGcAOYYsLN2Z8bbXq/meGDgGeItoEc9GspWZhASRXHYnrm1:lEc8H5fMLN2Kb7qrGlFtov9GsqRXHYri

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  4d748536cef3a7166b961c5fd253db48_JaffaCakes118
- Size
  
  728KB
- MD5
  
  4d748536cef3a7166b961c5fd253db48
- SHA1
  
  6d898b4b173f3948c4e7501c29415e4ffe02e88c
- SHA256
  
  294cc6678f78226cd14a549636a9dfe893ef2e1284af3cc7c38cd45cf0c7791f
- SHA512
  
  19a49ee1d6d46f632d50be425e8f3ff0189860b5f9fb735e7054deacd405803c26bcbd09eb126a10fce0d4706991c2ff0b1c7dba8349b53430b87f38416a516b
- SSDEEP
  
  12288:lEcF8D2K53tGcAOYYsLN2Z8bbXq/meGDgGeItoEc9GspWZhASRXHYnrm1:lEc8H5fMLN2Kb7qrGlFtov9GsqRXHYri
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation