cf37ac15ca29da24e5db4bb7656de43e63703dff97a01bd01636d02fdbeb5047 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

95fa4fcc5457f0e460a4c78f5a1db666_JaffaCakes118
Size

731KB
Sample

240814-nykb2szhkc
MD5

95fa4fcc5457f0e460a4c78f5a1db666
SHA1

42790837972979c5368b381c0baae99230f63cbb
SHA256

cf37ac15ca29da24e5db4bb7656de43e63703dff97a01bd01636d02fdbeb5047
SHA512

5e9b3f4ce35f343f4035995fff2292b85bb77842f08ffdb334287c15bfaa809fc2b018be119e7b381a916adaaa90ee73964d53be8bd95d1dbdf55f47c933fc22
SSDEEP

12288:Jaingtd/9iCpVEZxzraxdUdpmhFmjnDgGeIttwoPR5pWZhAIRXHYnrmD:JaigD/ArravUdshwnlFttwYQRXHYrmD

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  95fa4fcc5457f0e460a4c78f5a1db666_JaffaCakes118
- Size
  
  731KB
- MD5
  
  95fa4fcc5457f0e460a4c78f5a1db666
- SHA1
  
  42790837972979c5368b381c0baae99230f63cbb
- SHA256
  
  cf37ac15ca29da24e5db4bb7656de43e63703dff97a01bd01636d02fdbeb5047
- SHA512
  
  5e9b3f4ce35f343f4035995fff2292b85bb77842f08ffdb334287c15bfaa809fc2b018be119e7b381a916adaaa90ee73964d53be8bd95d1dbdf55f47c933fc22
- SSDEEP
  
  12288:Jaingtd/9iCpVEZxzraxdUdpmhFmjnDgGeIttwoPR5pWZhAIRXHYnrmD:JaigD/ArravUdshwnlFttwYQRXHYrmD
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation