06fb9043e57c31ea42a0cc2d6cc5d17776d78c8b8cf5fc6177da48206d99ae41 | Triage

Sharing

General

Target

970fb95018e770e51e883939681daf22_JaffaCakes118
Size

728KB
Sample

240814-wdw44svfma
MD5

970fb95018e770e51e883939681daf22
SHA1

cbd8b6fa6550416452eaef74737a3abc1bcff6fa
SHA256

06fb9043e57c31ea42a0cc2d6cc5d17776d78c8b8cf5fc6177da48206d99ae41
SHA512

5c47bc448146483defeddb736c563ff3187f7f29bda6428a2b57eae9179d9bd35512be8e7806c1e13ed274114abed423efbe44924771ead1612da75d55acb801
SSDEEP

12288:lEcF8D2K53tGcAOYYsLN2Z8bbXR/meGDgGeItoEc9GspWZhASRXHYnrmB:lEc8H5fMLN2Kb7RrGlFtov9GsqRXHYru

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  970fb95018e770e51e883939681daf22_JaffaCakes118
- Size
  
  728KB
- MD5
  
  970fb95018e770e51e883939681daf22
- SHA1
  
  cbd8b6fa6550416452eaef74737a3abc1bcff6fa
- SHA256
  
  06fb9043e57c31ea42a0cc2d6cc5d17776d78c8b8cf5fc6177da48206d99ae41
- SHA512
  
  5c47bc448146483defeddb736c563ff3187f7f29bda6428a2b57eae9179d9bd35512be8e7806c1e13ed274114abed423efbe44924771ead1612da75d55acb801
- SSDEEP
  
  12288:lEcF8D2K53tGcAOYYsLN2Z8bbXR/meGDgGeItoEc9GspWZhASRXHYnrmB:lEc8H5fMLN2Kb7RrGlFtov9GsqRXHYru
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation