177979a1d60e03d690fe84479538ed2ca95cee843ee25ef27e5683bb8f226b35 | Triage

Sharing

General

Target

4da18a129d8684f8bced9339f444ecb4_JaffaCakes118
Size

728KB
Sample

240716-ky84mavbrp
MD5

4da18a129d8684f8bced9339f444ecb4
SHA1

19c1676a5dd4ab462cee862554f94ff8b142a0a5
SHA256

177979a1d60e03d690fe84479538ed2ca95cee843ee25ef27e5683bb8f226b35
SHA512

74b6c60799fac697bc8a8d12455036dcc4a226ac8c79c37fd8e5db874dc0e3fb6dbb6de674bd3bea966a9d8e4bb29514cb51ff0c702c09265b9c40e83a9e37ab
SSDEEP

12288:lEcF8D2K53tGcAOYYsLN2Z8bbXL/meGDgGeItoEc9GspWZhASRXHYnrmj:lEc8H5fMLN2Kb7LrGlFtov9GsqRXHYrg

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  4da18a129d8684f8bced9339f444ecb4_JaffaCakes118
- Size
  
  728KB
- MD5
  
  4da18a129d8684f8bced9339f444ecb4
- SHA1
  
  19c1676a5dd4ab462cee862554f94ff8b142a0a5
- SHA256
  
  177979a1d60e03d690fe84479538ed2ca95cee843ee25ef27e5683bb8f226b35
- SHA512
  
  74b6c60799fac697bc8a8d12455036dcc4a226ac8c79c37fd8e5db874dc0e3fb6dbb6de674bd3bea966a9d8e4bb29514cb51ff0c702c09265b9c40e83a9e37ab
- SSDEEP
  
  12288:lEcF8D2K53tGcAOYYsLN2Z8bbXL/meGDgGeItoEc9GspWZhASRXHYnrmj:lEc8H5fMLN2Kb7LrGlFtov9GsqRXHYrg
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation