392e3b9b698f46f42aad1989bc6b5d7bdae93ba0bc205f57de2808c95c55ca4e | Triage

Sharing

General

Target

714f722468e3639557e11f947ddef78f_JaffaCakes118
Size

91KB
Sample

240725-1bxebawbnm
MD5

714f722468e3639557e11f947ddef78f
SHA1

cda8393f657535fd93720bb0a381f8d9920952f1
SHA256

392e3b9b698f46f42aad1989bc6b5d7bdae93ba0bc205f57de2808c95c55ca4e
SHA512

eaa9db4236a086978796c31b79711bd1833dc70836ad91c6e274c5214e4fc469ceb4c4ae37d420b8a71a602ffbf657b3e8819e48edeac5a54798117a0fa00584
SSDEEP

1536:N2z6MYKR06YWeR8alKP1z8ykqgR/QM1cl9+GvoQ+3FH5e+qtu6iZzcEK:KdYKfYWeROrkNR/QM1clSe+qtLczcL

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  714f722468e3639557e11f947ddef78f_JaffaCakes118
- Size
  
  91KB
- MD5
  
  714f722468e3639557e11f947ddef78f
- SHA1
  
  cda8393f657535fd93720bb0a381f8d9920952f1
- SHA256
  
  392e3b9b698f46f42aad1989bc6b5d7bdae93ba0bc205f57de2808c95c55ca4e
- SHA512
  
  eaa9db4236a086978796c31b79711bd1833dc70836ad91c6e274c5214e4fc469ceb4c4ae37d420b8a71a602ffbf657b3e8819e48edeac5a54798117a0fa00584
- SSDEEP
  
  1536:N2z6MYKR06YWeR8alKP1z8ykqgR/QM1cl9+GvoQ+3FH5e+qtu6iZzcEK:KdYKfYWeROrkNR/QM1clSe+qtLczcL
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation