c5ea55e68fe359b8491ef0cc90062c067319ebaaaf352e71cef0810241c84efb | Triage

Sharing

General

Target

74585aa7abf7b437b1dc065217a8b06b_JaffaCakes118
Size

734KB
Sample

240726-q8qmxsvhle
MD5

74585aa7abf7b437b1dc065217a8b06b
SHA1

3fc054149f804945c72ea6eb408eaaca630500eb
SHA256

c5ea55e68fe359b8491ef0cc90062c067319ebaaaf352e71cef0810241c84efb
SHA512

dda8f3d354b86b4cea087ca431bcf7fa8889766b9e2910a7cb12a81421c721da2b85092a7e40c73fd4a2009d5094685aa4ec6c13936b7e3ae806489eb399a5d7
SSDEEP

12288:bkZMrKuT9eES2EGfKMlAvDuicrvXXKmtKDgGeIttwoPR5pWZhAIRXHYnrmF:bkZCXTqjMWvVcLXXxKlFttwYQRXHYrmF

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  74585aa7abf7b437b1dc065217a8b06b_JaffaCakes118
- Size
  
  734KB
- MD5
  
  74585aa7abf7b437b1dc065217a8b06b
- SHA1
  
  3fc054149f804945c72ea6eb408eaaca630500eb
- SHA256
  
  c5ea55e68fe359b8491ef0cc90062c067319ebaaaf352e71cef0810241c84efb
- SHA512
  
  dda8f3d354b86b4cea087ca431bcf7fa8889766b9e2910a7cb12a81421c721da2b85092a7e40c73fd4a2009d5094685aa4ec6c13936b7e3ae806489eb399a5d7
- SSDEEP
  
  12288:bkZMrKuT9eES2EGfKMlAvDuicrvXXKmtKDgGeIttwoPR5pWZhAIRXHYnrmF:bkZCXTqjMWvVcLXXxKlFttwYQRXHYrmF
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation