0fd97f13bb24d8b7697f5489436e137627fc36a9055795cd5250555945013ca0 | Triage

Sharing

General

Target

a4dc47e2d16a0a4d8fb2e980527b7aba_JaffaCakes118
Size

734KB
Sample

240818-bwqd3a1bnj
MD5

a4dc47e2d16a0a4d8fb2e980527b7aba
SHA1

a868b69a4da093f53813d5d7dbafe1d54de00436
SHA256

0fd97f13bb24d8b7697f5489436e137627fc36a9055795cd5250555945013ca0
SHA512

c7226138e17af7a18740f7561b41b630f65ac1cfedd0ba87218e14fc5dfd11ee5e7bf203b53813c450dfe79474fb885aa7f0b850994db2d80e8138474451c265
SSDEEP

12288:bkZMrKuT9eES2EGfKMlAvDuicrvXCKmtKDgGeIttwoPR5pWZhAIRXHYnrmj:bkZCXTqjMWvVcLXCxKlFttwYQRXHYrmj

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  a4dc47e2d16a0a4d8fb2e980527b7aba_JaffaCakes118
- Size
  
  734KB
- MD5
  
  a4dc47e2d16a0a4d8fb2e980527b7aba
- SHA1
  
  a868b69a4da093f53813d5d7dbafe1d54de00436
- SHA256
  
  0fd97f13bb24d8b7697f5489436e137627fc36a9055795cd5250555945013ca0
- SHA512
  
  c7226138e17af7a18740f7561b41b630f65ac1cfedd0ba87218e14fc5dfd11ee5e7bf203b53813c450dfe79474fb885aa7f0b850994db2d80e8138474451c265
- SSDEEP
  
  12288:bkZMrKuT9eES2EGfKMlAvDuicrvXCKmtKDgGeIttwoPR5pWZhAIRXHYnrmj:bkZCXTqjMWvVcLXCxKlFttwYQRXHYrmj
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation