68061c0e49bcb6348448e689de06106e271d19d7681a83fb64297e5e22ea4f02 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a08b38e57785078a9f4b5e03207a415d_JaffaCakes118
Size

733KB
Sample

240817-axe42szeqn
MD5

a08b38e57785078a9f4b5e03207a415d
SHA1

ffa7c077c2029b152f5b298641877bff85d88c2a
SHA256

68061c0e49bcb6348448e689de06106e271d19d7681a83fb64297e5e22ea4f02
SHA512

f83bed8ebdd36287772100b1a6468625c5ed1f852a8ea85c8682e36d4d74ab96d02375c4ba04a1f31fc8240967d91b536bf8f7d0a958df6b742966dd3e720530
SSDEEP

12288:13Fpj4rBRLukn+zKg2oOR2OQl5jAdmxQDgGeItGBV07XpWZhASRXHYnrmR:1VpUFRUgoOwOY5jAqQlFtWVAqRXHYrmR

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  a08b38e57785078a9f4b5e03207a415d_JaffaCakes118
- Size
  
  733KB
- MD5
  
  a08b38e57785078a9f4b5e03207a415d
- SHA1
  
  ffa7c077c2029b152f5b298641877bff85d88c2a
- SHA256
  
  68061c0e49bcb6348448e689de06106e271d19d7681a83fb64297e5e22ea4f02
- SHA512
  
  f83bed8ebdd36287772100b1a6468625c5ed1f852a8ea85c8682e36d4d74ab96d02375c4ba04a1f31fc8240967d91b536bf8f7d0a958df6b742966dd3e720530
- SSDEEP
  
  12288:13Fpj4rBRLukn+zKg2oOR2OQl5jAdmxQDgGeItGBV07XpWZhASRXHYnrmR:1VpUFRUgoOwOY5jAqQlFtWVAqRXHYrmR
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation