681f6ab48060c5bb52583d582c0995bf7925d0f3502f7cc81f48cedcccca2cbd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a00890657d0bd3da583ebd0fa6094d29_JaffaCakes118
Size

728KB
Sample

240816-1hlw6aydqc
MD5

a00890657d0bd3da583ebd0fa6094d29
SHA1

f5ec5c9a213f4024c30b20862a883a90812c5e68
SHA256

681f6ab48060c5bb52583d582c0995bf7925d0f3502f7cc81f48cedcccca2cbd
SHA512

50098725ee2e77627f8b2a9101bfcacb27a25163633899e04c98f33f7f7cf1a7beb101787efb2a9cb9afc6cca557f86f3a82803bb79e85245c1cc52af93a9910
SSDEEP

12288:lEcF8D2K53tGcAOYYsLN2Z8bbXd/meGDgGeItoEc9GspWZhASRXHYnrmX:lEc8H5fMLN2Kb7drGlFtov9GsqRXHYrs

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  a00890657d0bd3da583ebd0fa6094d29_JaffaCakes118
- Size
  
  728KB
- MD5
  
  a00890657d0bd3da583ebd0fa6094d29
- SHA1
  
  f5ec5c9a213f4024c30b20862a883a90812c5e68
- SHA256
  
  681f6ab48060c5bb52583d582c0995bf7925d0f3502f7cc81f48cedcccca2cbd
- SHA512
  
  50098725ee2e77627f8b2a9101bfcacb27a25163633899e04c98f33f7f7cf1a7beb101787efb2a9cb9afc6cca557f86f3a82803bb79e85245c1cc52af93a9910
- SSDEEP
  
  12288:lEcF8D2K53tGcAOYYsLN2Z8bbXd/meGDgGeItoEc9GspWZhASRXHYnrmX:lEc8H5fMLN2Kb7drGlFtov9GsqRXHYrs
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation