3a4b830f4acec49779e5acc743f1e71d23a55236991db15082247598a2737328 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

65a7745fe0c38e950cc37fad5f6435d1_JaffaCakes118
Size

97KB
Sample

240723-b3922szgkf
MD5

65a7745fe0c38e950cc37fad5f6435d1
SHA1

89a0c6fd1eb5bc7a47c184d26980cf36b138d964
SHA256

3a4b830f4acec49779e5acc743f1e71d23a55236991db15082247598a2737328
SHA512

0675ad109813316474476a16b7dc2da16137a1b7c983bcc33d5ced0c4126832ccdf27214b1b63c3f8a08dfbc73354b6580dbd87bf5e5db84fed9821cdfe46008
SSDEEP

1536:28DhELyiDdKzGIbo6M1Do6M1cmctTUybFIe/rUYejxKIjTKOj:Vhz4dKzZ9C95tU6FRwjxdKO

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  65a7745fe0c38e950cc37fad5f6435d1_JaffaCakes118
- Size
  
  97KB
- MD5
  
  65a7745fe0c38e950cc37fad5f6435d1
- SHA1
  
  89a0c6fd1eb5bc7a47c184d26980cf36b138d964
- SHA256
  
  3a4b830f4acec49779e5acc743f1e71d23a55236991db15082247598a2737328
- SHA512
  
  0675ad109813316474476a16b7dc2da16137a1b7c983bcc33d5ced0c4126832ccdf27214b1b63c3f8a08dfbc73354b6580dbd87bf5e5db84fed9821cdfe46008
- SSDEEP
  
  1536:28DhELyiDdKzGIbo6M1Do6M1cmctTUybFIe/rUYejxKIjTKOj:Vhz4dKzZ9C95tU6FRwjxdKO
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation