7944c2996c9c1b991b6b94233a43023bc02ce9d7dcf8ec031e219a0220e3f115 | Triage

Sharing

General

Target

639f3e5b8bed77788c92cfa0e0ad9bbe_JaffaCakes118
Size

26KB
Sample

240722-saaj6atgqm
MD5

639f3e5b8bed77788c92cfa0e0ad9bbe
SHA1

9d3a2e952abd26bb0d34f1170f3627291f9581c9
SHA256

7944c2996c9c1b991b6b94233a43023bc02ce9d7dcf8ec031e219a0220e3f115
SHA512

69ab823a3cf5a058450b798cf77432dae16b4dccd9e93fd2e318050e1bc2476d2c1baca8bb2dc057a5144f4bdb618948c0bf83e982ccd9ce8c5c52559813239f
SSDEEP

768:iMcyX5zmDF0owvQd8HXVEu5TWo/Sv/vOa:aytmDiDvQdQEUWxHvOa

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  639f3e5b8bed77788c92cfa0e0ad9bbe_JaffaCakes118
- Size
  
  26KB
- MD5
  
  639f3e5b8bed77788c92cfa0e0ad9bbe
- SHA1
  
  9d3a2e952abd26bb0d34f1170f3627291f9581c9
- SHA256
  
  7944c2996c9c1b991b6b94233a43023bc02ce9d7dcf8ec031e219a0220e3f115
- SHA512
  
  69ab823a3cf5a058450b798cf77432dae16b4dccd9e93fd2e318050e1bc2476d2c1baca8bb2dc057a5144f4bdb618948c0bf83e982ccd9ce8c5c52559813239f
- SSDEEP
  
  768:iMcyX5zmDF0owvQd8HXVEu5TWo/Sv/vOa:aytmDiDvQdQEUWxHvOa
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation