4d36d30627662dde8e05245adff774ce2a75caf5b4a54a39c455df56757520bd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8b59028ff4f6d71e765b3a711d58151b_JaffaCakes118
Size

733KB
Sample

240811-wbgawazemr
MD5

8b59028ff4f6d71e765b3a711d58151b
SHA1

6bdc1aa94c506d1fb418a2f733fdd00f982e4a1d
SHA256

4d36d30627662dde8e05245adff774ce2a75caf5b4a54a39c455df56757520bd
SHA512

5552af042422dbf2943a743eb42d7049f1f3e3858b25f8516869dd8015f1d5970cdb81a6ff1f6111fb0efb50acbdd3c1f27b7170a901df029389a566a83c0709
SSDEEP

12288:13Fpj4rBRLukn+zKg2oOR2OQl5XAdmxQDgGeItGBV07XpWZhASRXHYnrmM:1VpUFRUgoOwOY5XAqQlFtWVAqRXHYrmM

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  8b59028ff4f6d71e765b3a711d58151b_JaffaCakes118
- Size
  
  733KB
- MD5
  
  8b59028ff4f6d71e765b3a711d58151b
- SHA1
  
  6bdc1aa94c506d1fb418a2f733fdd00f982e4a1d
- SHA256
  
  4d36d30627662dde8e05245adff774ce2a75caf5b4a54a39c455df56757520bd
- SHA512
  
  5552af042422dbf2943a743eb42d7049f1f3e3858b25f8516869dd8015f1d5970cdb81a6ff1f6111fb0efb50acbdd3c1f27b7170a901df029389a566a83c0709
- SSDEEP
  
  12288:13Fpj4rBRLukn+zKg2oOR2OQl5XAdmxQDgGeItGBV07XpWZhASRXHYnrmM:1VpUFRUgoOwOY5XAqQlFtWVAqRXHYrmM
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation