a90e01f699fd5ff830a82dc7b28668be77b87047550743a3f6c7c17e5555ba2b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

82141a2ed8aceb05572e8877ad7da77c_JaffaCakes118
Size

734KB
Sample

240801-218z3s1epl
MD5

82141a2ed8aceb05572e8877ad7da77c
SHA1

2ad19a3175228f12624f5dd98a9f94fc7b078c14
SHA256

a90e01f699fd5ff830a82dc7b28668be77b87047550743a3f6c7c17e5555ba2b
SHA512

4abe57db2ee43ff5f36977634172377c8835c9ba938dd27ac97a2a5affc1c564dfefb80a480738d4d52232ffd14a7e2923454b3acb76fca392c1255b2b0b7f52
SSDEEP

12288:bkZMrKuT9eES2EGfKMlAvDuicrvXZKmtKDgGeIttwoPR5pWZhAIRXHYnrmZ:bkZCXTqjMWvVcLXZxKlFttwYQRXHYrmZ

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  82141a2ed8aceb05572e8877ad7da77c_JaffaCakes118
- Size
  
  734KB
- MD5
  
  82141a2ed8aceb05572e8877ad7da77c
- SHA1
  
  2ad19a3175228f12624f5dd98a9f94fc7b078c14
- SHA256
  
  a90e01f699fd5ff830a82dc7b28668be77b87047550743a3f6c7c17e5555ba2b
- SHA512
  
  4abe57db2ee43ff5f36977634172377c8835c9ba938dd27ac97a2a5affc1c564dfefb80a480738d4d52232ffd14a7e2923454b3acb76fca392c1255b2b0b7f52
- SSDEEP
  
  12288:bkZMrKuT9eES2EGfKMlAvDuicrvXZKmtKDgGeIttwoPR5pWZhAIRXHYnrmZ:bkZCXTqjMWvVcLXZxKlFttwYQRXHYrmZ
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation