10d45a2718adcd326747ef6fac03fe635e06884bf1b3c01a6eac0a4e4308554b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a1a4f0f09d4ca069e7119a6948eb9b0a_JaffaCakes118
Size

733KB
Sample

240817-h5n1xstdpf
MD5

a1a4f0f09d4ca069e7119a6948eb9b0a
SHA1

212f2c43d1b9c2e4a2f81b7f1170973a1eafdc53
SHA256

10d45a2718adcd326747ef6fac03fe635e06884bf1b3c01a6eac0a4e4308554b
SHA512

c36a136225adcefd4039d0ecd9062b8e93d09ec837d3f3b1c98f28b87d47db45de173dbc9c7a40d33e113e5d2d899eea7600dafa7392cd42febd54f5a319eafe
SSDEEP

12288:13Fpj4rBRLukn+zKg2oOR2OQl51AdmxQDgGeItGBV07XpWZhASRXHYnrmV:1VpUFRUgoOwOY51AqQlFtWVAqRXHYrmV

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  a1a4f0f09d4ca069e7119a6948eb9b0a_JaffaCakes118
- Size
  
  733KB
- MD5
  
  a1a4f0f09d4ca069e7119a6948eb9b0a
- SHA1
  
  212f2c43d1b9c2e4a2f81b7f1170973a1eafdc53
- SHA256
  
  10d45a2718adcd326747ef6fac03fe635e06884bf1b3c01a6eac0a4e4308554b
- SHA512
  
  c36a136225adcefd4039d0ecd9062b8e93d09ec837d3f3b1c98f28b87d47db45de173dbc9c7a40d33e113e5d2d899eea7600dafa7392cd42febd54f5a319eafe
- SSDEEP
  
  12288:13Fpj4rBRLukn+zKg2oOR2OQl51AdmxQDgGeItGBV07XpWZhASRXHYnrmV:1VpUFRUgoOwOY51AqQlFtWVAqRXHYrmV
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation