36ed5ea6168ceb2e5636a27116c5b86960e78892606d5ed74b6eb1dede87715f | Triage

Sharing

General

Target

654d9ed3f7fe24c061f8c52b26125a79_JaffaCakes118
Size

728KB
Sample

240722-3tlrmsvflg
MD5

654d9ed3f7fe24c061f8c52b26125a79
SHA1

49e77e2e5ca58d4e57b7e5aabdedd709ae715401
SHA256

36ed5ea6168ceb2e5636a27116c5b86960e78892606d5ed74b6eb1dede87715f
SHA512

3665f0103938e2d4118f52cbed71eec8b2aa4a8b765054553f3d70f82e7122b9fb283422fc2047ff6ae048f27df053f02ea443b2a8be8ab95112c4a6f2bd609c
SSDEEP

12288:z2/I3CMZC4u8YBbY5zgHWHmt8qM+mmcKDgGeItoEc9GspWZhASRXHYnrmd:z2QSmCrmgHCmKqM+kKlFtov9GsqRXHYO

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  654d9ed3f7fe24c061f8c52b26125a79_JaffaCakes118
- Size
  
  728KB
- MD5
  
  654d9ed3f7fe24c061f8c52b26125a79
- SHA1
  
  49e77e2e5ca58d4e57b7e5aabdedd709ae715401
- SHA256
  
  36ed5ea6168ceb2e5636a27116c5b86960e78892606d5ed74b6eb1dede87715f
- SHA512
  
  3665f0103938e2d4118f52cbed71eec8b2aa4a8b765054553f3d70f82e7122b9fb283422fc2047ff6ae048f27df053f02ea443b2a8be8ab95112c4a6f2bd609c
- SSDEEP
  
  12288:z2/I3CMZC4u8YBbY5zgHWHmt8qM+mmcKDgGeItoEc9GspWZhASRXHYnrmd:z2QSmCrmgHCmKqM+kKlFtov9GsqRXHYO
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation