b7f670b6fa6ece000cceff076291e5f17c77e0f6eea433234c97f0c5d12d94cb | Triage

Sharing

General

Target

7381901296b22a1f58c8be57289b30dc_JaffaCakes118
Size

731KB
Sample

240726-lmc3gszbrl
MD5

7381901296b22a1f58c8be57289b30dc
SHA1

ff25ef197f8bf2e8fcdd226af19a608d5b4f09b6
SHA256

b7f670b6fa6ece000cceff076291e5f17c77e0f6eea433234c97f0c5d12d94cb
SHA512

bd3573a6c607249ac198c6103a4be12cfdcd3d258c25e0b1d17c202a1e63ec0a9153673a0628da46df0e9872a92ad2589e103691b238f6c4e80ca6f09b3cf029
SSDEEP

12288:Jaingtd/9iCpVEZxzraxdUdpmGFmjnDgGeIttwoPR5pWZhAIRXHYnrmC:JaigD/ArravUdsGwnlFttwYQRXHYrmC

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  7381901296b22a1f58c8be57289b30dc_JaffaCakes118
- Size
  
  731KB
- MD5
  
  7381901296b22a1f58c8be57289b30dc
- SHA1
  
  ff25ef197f8bf2e8fcdd226af19a608d5b4f09b6
- SHA256
  
  b7f670b6fa6ece000cceff076291e5f17c77e0f6eea433234c97f0c5d12d94cb
- SHA512
  
  bd3573a6c607249ac198c6103a4be12cfdcd3d258c25e0b1d17c202a1e63ec0a9153673a0628da46df0e9872a92ad2589e103691b238f6c4e80ca6f09b3cf029
- SSDEEP
  
  12288:Jaingtd/9iCpVEZxzraxdUdpmGFmjnDgGeIttwoPR5pWZhAIRXHYnrmC:JaigD/ArravUdsGwnlFttwYQRXHYrmC
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation