e3f1dcb5539dca661f8bd619d015491ff96d41ecb2b1869bf2452b36df013d73 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

60b7781f39d34e6fd0d6a317e7910d97_JaffaCakes118
Size

728KB
Sample

240721-vsvn6ayarp
MD5

60b7781f39d34e6fd0d6a317e7910d97
SHA1

cf37f0cce4cc9ad74fc45bd7bd583d22bb275fa3
SHA256

e3f1dcb5539dca661f8bd619d015491ff96d41ecb2b1869bf2452b36df013d73
SHA512

3880d8971463c3863c191a5f37dd13ad44a533b341e789a28089b6a6e0e07272391ca81df5b0c6afe505ca8a7f7fd9ff70c635327c64f9a77bf80e2437c46e94
SSDEEP

12288:lEcF8D2K53tGcAOYYsLN2Z8bbXl/meGDgGeItoEc9GspWZhASRXHYnrmp:lEc8H5fMLN2Kb7lrGlFtov9GsqRXHYri

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  60b7781f39d34e6fd0d6a317e7910d97_JaffaCakes118
- Size
  
  728KB
- MD5
  
  60b7781f39d34e6fd0d6a317e7910d97
- SHA1
  
  cf37f0cce4cc9ad74fc45bd7bd583d22bb275fa3
- SHA256
  
  e3f1dcb5539dca661f8bd619d015491ff96d41ecb2b1869bf2452b36df013d73
- SHA512
  
  3880d8971463c3863c191a5f37dd13ad44a533b341e789a28089b6a6e0e07272391ca81df5b0c6afe505ca8a7f7fd9ff70c635327c64f9a77bf80e2437c46e94
- SSDEEP
  
  12288:lEcF8D2K53tGcAOYYsLN2Z8bbXl/meGDgGeItoEc9GspWZhASRXHYnrmp:lEc8H5fMLN2Kb7lrGlFtov9GsqRXHYri
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation