11cf8515b40b801292b4f79b44ca58b48cc82214931c1327e2593ddc2f745bff | Triage

Sharing

General

Target

7332b68baf8ae269b17369e4f727e520_JaffaCakes118
Size

731KB
Sample

240726-jtq7ksvgqm
MD5

7332b68baf8ae269b17369e4f727e520
SHA1

a469581cf7e593de0eb71370896db85ab6cab146
SHA256

11cf8515b40b801292b4f79b44ca58b48cc82214931c1327e2593ddc2f745bff
SHA512

a8e13b690ea8fa7bc38c2221c04b0ff6dc104ef331e8307cf9cdbef9281af9966d1243f2d66a338e6ac18540f9a3aea4d90c2bb8578bdbe7b30c79d7e7ddaf1e
SSDEEP

12288:Jaingtd/9iCpVEZxzraxdUdpmtFmjnDgGeIttwoPR5pWZhAIRXHYnrmj:JaigD/ArravUdstwnlFttwYQRXHYrmj

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  7332b68baf8ae269b17369e4f727e520_JaffaCakes118
- Size
  
  731KB
- MD5
  
  7332b68baf8ae269b17369e4f727e520
- SHA1
  
  a469581cf7e593de0eb71370896db85ab6cab146
- SHA256
  
  11cf8515b40b801292b4f79b44ca58b48cc82214931c1327e2593ddc2f745bff
- SHA512
  
  a8e13b690ea8fa7bc38c2221c04b0ff6dc104ef331e8307cf9cdbef9281af9966d1243f2d66a338e6ac18540f9a3aea4d90c2bb8578bdbe7b30c79d7e7ddaf1e
- SSDEEP
  
  12288:Jaingtd/9iCpVEZxzraxdUdpmtFmjnDgGeIttwoPR5pWZhAIRXHYnrmj:JaigD/ArravUdstwnlFttwYQRXHYrmj
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation