2bfed9c27f587ecc4206f4adb7eaaa830fe7ebf617cf0257825c49be66a34ef2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b868f2b3f0ba31837059454b6e708d59_JaffaCakes118
Size

734KB
Sample

240822-vgajvaxgng
MD5

b868f2b3f0ba31837059454b6e708d59
SHA1

b89d1e1d51c2a6b9fd27cccdd4db7bebb4c044f5
SHA256

2bfed9c27f587ecc4206f4adb7eaaa830fe7ebf617cf0257825c49be66a34ef2
SHA512

92cdbe51f0bb27257e07a5e0c888c745722d2c1caab6dae30f382c899724dede49a18e02a7799e52d3caf76039a999eeb53a564d48ee09d733f27f6fc46aaf69
SSDEEP

12288:bkZMrKuT9eES2EGfKMlAvDuicrvXRKmtKDgGeIttwoPR5pWZhAIRXHYnrmN:bkZCXTqjMWvVcLXRxKlFttwYQRXHYrmN

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  b868f2b3f0ba31837059454b6e708d59_JaffaCakes118
- Size
  
  734KB
- MD5
  
  b868f2b3f0ba31837059454b6e708d59
- SHA1
  
  b89d1e1d51c2a6b9fd27cccdd4db7bebb4c044f5
- SHA256
  
  2bfed9c27f587ecc4206f4adb7eaaa830fe7ebf617cf0257825c49be66a34ef2
- SHA512
  
  92cdbe51f0bb27257e07a5e0c888c745722d2c1caab6dae30f382c899724dede49a18e02a7799e52d3caf76039a999eeb53a564d48ee09d733f27f6fc46aaf69
- SSDEEP
  
  12288:bkZMrKuT9eES2EGfKMlAvDuicrvXRKmtKDgGeIttwoPR5pWZhAIRXHYnrmN:bkZCXTqjMWvVcLXRxKlFttwYQRXHYrmN
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation