cb10e81a6f877d7a1d29024d9db7cf9f856cdce0556c36e5cabe90cfc0048ba4 | Triage

Sharing

General

Target

6ffd01a6f05b5837ad2151581ad6e68a_JaffaCakes118
Size

734KB
Sample

240725-rxzl5atepn
MD5

6ffd01a6f05b5837ad2151581ad6e68a
SHA1

348403f15c8b35c865eb9a1ae9242c1896ccece0
SHA256

cb10e81a6f877d7a1d29024d9db7cf9f856cdce0556c36e5cabe90cfc0048ba4
SHA512

0a1b0eb233ee538bd09904aa40fb5f3ea9cfe4b744bae53f3f6833bfa0604391f5759714102134e7d06997c197a88f5dd553161869d49a2352a039fd09392d1f
SSDEEP

12288:bkZMrKuT9eES2EGfKMlAvDuicrvXWKmtKDgGeIttwoPR5pWZhAIRXHYnrmb:bkZCXTqjMWvVcLXWxKlFttwYQRXHYrmb

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  6ffd01a6f05b5837ad2151581ad6e68a_JaffaCakes118
- Size
  
  734KB
- MD5
  
  6ffd01a6f05b5837ad2151581ad6e68a
- SHA1
  
  348403f15c8b35c865eb9a1ae9242c1896ccece0
- SHA256
  
  cb10e81a6f877d7a1d29024d9db7cf9f856cdce0556c36e5cabe90cfc0048ba4
- SHA512
  
  0a1b0eb233ee538bd09904aa40fb5f3ea9cfe4b744bae53f3f6833bfa0604391f5759714102134e7d06997c197a88f5dd553161869d49a2352a039fd09392d1f
- SSDEEP
  
  12288:bkZMrKuT9eES2EGfKMlAvDuicrvXWKmtKDgGeIttwoPR5pWZhAIRXHYnrmb:bkZCXTqjMWvVcLXWxKlFttwYQRXHYrmb
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation