dc681fab84b5c3ab483ce8ca0512084f8a77f50b79aa953e39749768456f8efd | Triage

Sharing

General

Target

a01064cf860e53f716480af99dddf7f8_JaffaCakes118
Size

728KB
Sample

240816-1ny4nsygqb
MD5

a01064cf860e53f716480af99dddf7f8
SHA1

aac6d06b5029f9f1548dafdc884c6f54758bd1de
SHA256

dc681fab84b5c3ab483ce8ca0512084f8a77f50b79aa953e39749768456f8efd
SHA512

ff2c16d0e5fe21c56bc708500181046996f7ce62dd395bad454f3577fb24f3c7a52448850a6d2591da33d8313313a861cb743472e0d424d01a89eb1893c55b8b
SSDEEP

12288:lEcF8D2K53tGcAOYYsLN2Z8bbXG/meGDgGeItoEc9GspWZhASRXHYnrms:lEc8H5fMLN2Kb7GrGlFtov9GsqRXHYr7

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  a01064cf860e53f716480af99dddf7f8_JaffaCakes118
- Size
  
  728KB
- MD5
  
  a01064cf860e53f716480af99dddf7f8
- SHA1
  
  aac6d06b5029f9f1548dafdc884c6f54758bd1de
- SHA256
  
  dc681fab84b5c3ab483ce8ca0512084f8a77f50b79aa953e39749768456f8efd
- SHA512
  
  ff2c16d0e5fe21c56bc708500181046996f7ce62dd395bad454f3577fb24f3c7a52448850a6d2591da33d8313313a861cb743472e0d424d01a89eb1893c55b8b
- SSDEEP
  
  12288:lEcF8D2K53tGcAOYYsLN2Z8bbXG/meGDgGeItoEc9GspWZhASRXHYnrms:lEc8H5fMLN2Kb7GrGlFtov9GsqRXHYr7
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation