23136b30fae3aaca6451d97242c522b3c2eca7a3a7910370bd1c2e3028203662 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5ee49d2f3c5922e3386540974e6b3eba_JaffaCakes118
Size

731KB
Sample

240720-d7nqqavcjm
MD5

5ee49d2f3c5922e3386540974e6b3eba
SHA1

ebbd375444b7668b31dbae421bd84a386b2b4d6f
SHA256

23136b30fae3aaca6451d97242c522b3c2eca7a3a7910370bd1c2e3028203662
SHA512

d5f27a60f3c5abcf6bdd1c2dad1f3e9caba2f44d88e8e44f5917395bcf3134e5538e104e8d5ecf7c3ba923fdbc36da325935e2f9686fa3079916ce39e26ee215
SSDEEP

12288:Jaingtd/9iCpVEZxzraxdUdpmxFmjnDgGeIttwoPR5pWZhAIRXHYnrms:JaigD/ArravUdsxwnlFttwYQRXHYrms

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  5ee49d2f3c5922e3386540974e6b3eba_JaffaCakes118
- Size
  
  731KB
- MD5
  
  5ee49d2f3c5922e3386540974e6b3eba
- SHA1
  
  ebbd375444b7668b31dbae421bd84a386b2b4d6f
- SHA256
  
  23136b30fae3aaca6451d97242c522b3c2eca7a3a7910370bd1c2e3028203662
- SHA512
  
  d5f27a60f3c5abcf6bdd1c2dad1f3e9caba2f44d88e8e44f5917395bcf3134e5538e104e8d5ecf7c3ba923fdbc36da325935e2f9686fa3079916ce39e26ee215
- SSDEEP
  
  12288:Jaingtd/9iCpVEZxzraxdUdpmxFmjnDgGeIttwoPR5pWZhAIRXHYnrms:JaigD/ArravUdsxwnlFttwYQRXHYrms
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation