8af06fd2a73bde2112266b10a46b4f6cf606d5833a120a40d341136872ccf930 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b6ac2db7d71c9c8b08732a1c098cea8d_JaffaCakes118
Size

734KB
Sample

240822-haj4gswflq
MD5

b6ac2db7d71c9c8b08732a1c098cea8d
SHA1

569994b1d15459275f5c7f422f24eb78c64a3984
SHA256

8af06fd2a73bde2112266b10a46b4f6cf606d5833a120a40d341136872ccf930
SHA512

c97c808263756339b996c622792d5a1098c64b28dfa2020a244f86985dc3ba51e48595cdb80402c3099a1905f11b654ca27cf7f291cf092c721e78c3374c4c52
SSDEEP

12288:bkZMrKuT9eES2EGfKMlAvDuicrvXvKmtKDgGeIttwoPR5pWZhAIRXHYnrmF:bkZCXTqjMWvVcLXvxKlFttwYQRXHYrmF

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  b6ac2db7d71c9c8b08732a1c098cea8d_JaffaCakes118
- Size
  
  734KB
- MD5
  
  b6ac2db7d71c9c8b08732a1c098cea8d
- SHA1
  
  569994b1d15459275f5c7f422f24eb78c64a3984
- SHA256
  
  8af06fd2a73bde2112266b10a46b4f6cf606d5833a120a40d341136872ccf930
- SHA512
  
  c97c808263756339b996c622792d5a1098c64b28dfa2020a244f86985dc3ba51e48595cdb80402c3099a1905f11b654ca27cf7f291cf092c721e78c3374c4c52
- SSDEEP
  
  12288:bkZMrKuT9eES2EGfKMlAvDuicrvXvKmtKDgGeIttwoPR5pWZhAIRXHYnrmF:bkZCXTqjMWvVcLXvxKlFttwYQRXHYrmF
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation