c84f8848b48987330498c7d35d0fc509a9452c99067219648c9d4d9f33ed2e61 | Triage

Sharing

General

Target

86bc8435236e1345103bea531f8c74a7_JaffaCakes118
Size

818KB
Sample

240810-tkdv1axakl
MD5

86bc8435236e1345103bea531f8c74a7
SHA1

29470f47720c3cd5e1a290e07ac998da6ad4f569
SHA256

c84f8848b48987330498c7d35d0fc509a9452c99067219648c9d4d9f33ed2e61
SHA512

d223e820873d2ee00b60e8f55977081a217b3c2108ae3a96bcaf439ce715fda54f23524f02d4a6302f74b9b7b17f0f720ebdcffdd2921fbe7a5c56a71007126f
SSDEEP

24576:KPEUOypp6swmemlFL1PHEJlFtov9G/6bqSqRXHYrmr:RULLY3Q9GibfYHYE

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  86bc8435236e1345103bea531f8c74a7_JaffaCakes118
- Size
  
  818KB
- MD5
  
  86bc8435236e1345103bea531f8c74a7
- SHA1
  
  29470f47720c3cd5e1a290e07ac998da6ad4f569
- SHA256
  
  c84f8848b48987330498c7d35d0fc509a9452c99067219648c9d4d9f33ed2e61
- SHA512
  
  d223e820873d2ee00b60e8f55977081a217b3c2108ae3a96bcaf439ce715fda54f23524f02d4a6302f74b9b7b17f0f720ebdcffdd2921fbe7a5c56a71007126f
- SSDEEP
  
  24576:KPEUOypp6swmemlFL1PHEJlFtov9G/6bqSqRXHYrmr:RULLY3Q9GibfYHYE
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation