2a73ffb6ae236170780170c1220d9663ba491559e8f6bf0ecc0ee107ad77968f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a7ceeca7a2ee3a811b7cdcf483bebdf1_JaffaCakes118
Size

728KB
Sample

240818-xf6l1a1hjq
MD5

a7ceeca7a2ee3a811b7cdcf483bebdf1
SHA1

e69a7bf9e26008bd50c6f3853b6550465e3566cb
SHA256

2a73ffb6ae236170780170c1220d9663ba491559e8f6bf0ecc0ee107ad77968f
SHA512

45ca79b27b2d6980814470f2772d6d025096c778f14dab095558c3fc9847d3468a4da05c7f28b3acb871341a5c7fa949276cbb2033f27b0d482377c98cc55259
SSDEEP

12288:lEcF8D2K53tGcAOYYsLN2Z8bbX3/meGDgGeItoEc9GspWZhASRXHYnrm3:lEc8H5fMLN2Kb73rGlFtov9GsqRXHYr0

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  a7ceeca7a2ee3a811b7cdcf483bebdf1_JaffaCakes118
- Size
  
  728KB
- MD5
  
  a7ceeca7a2ee3a811b7cdcf483bebdf1
- SHA1
  
  e69a7bf9e26008bd50c6f3853b6550465e3566cb
- SHA256
  
  2a73ffb6ae236170780170c1220d9663ba491559e8f6bf0ecc0ee107ad77968f
- SHA512
  
  45ca79b27b2d6980814470f2772d6d025096c778f14dab095558c3fc9847d3468a4da05c7f28b3acb871341a5c7fa949276cbb2033f27b0d482377c98cc55259
- SSDEEP
  
  12288:lEcF8D2K53tGcAOYYsLN2Z8bbX3/meGDgGeItoEc9GspWZhASRXHYnrm3:lEc8H5fMLN2Kb73rGlFtov9GsqRXHYr0
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation