3904f6f8cc9166588d1bff007fab64e4f786a34f5f5ce86d260119d441f30a0f | Triage

Sharing

General

Target

5bc2cc52519eb794d83a59c1c184d20f_JaffaCakes118
Size

80KB
Sample

240719-nmra8asbrd
MD5

5bc2cc52519eb794d83a59c1c184d20f
SHA1

9f9817ea1ee0a4371376224963a3fb650fb260a8
SHA256

3904f6f8cc9166588d1bff007fab64e4f786a34f5f5ce86d260119d441f30a0f
SHA512

168927d8a34c242bb796f1940102a4c83935fbb529c3c413488962de84db3c051452689ccac5002ae10b23072cc3da6bf3275e5fe62224da1c19f08b9dc7d1b7
SSDEEP

1536:q8DhEUQW0xYOBJyypgmDzVVmctTUybFIe/rUYejxKIjTKOj2:xhZQW0/nyypXtU6FRwjxdKO2

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  5bc2cc52519eb794d83a59c1c184d20f_JaffaCakes118
- Size
  
  80KB
- MD5
  
  5bc2cc52519eb794d83a59c1c184d20f
- SHA1
  
  9f9817ea1ee0a4371376224963a3fb650fb260a8
- SHA256
  
  3904f6f8cc9166588d1bff007fab64e4f786a34f5f5ce86d260119d441f30a0f
- SHA512
  
  168927d8a34c242bb796f1940102a4c83935fbb529c3c413488962de84db3c051452689ccac5002ae10b23072cc3da6bf3275e5fe62224da1c19f08b9dc7d1b7
- SSDEEP
  
  1536:q8DhEUQW0xYOBJyypgmDzVVmctTUybFIe/rUYejxKIjTKOj2:xhZQW0/nyypXtU6FRwjxdKO2
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation