1204d7ec8052f3985a67080420f32d8bbdada893340aa15fff05af23509d2a9c | Triage

Sharing

General

Target

b86b2f1514089c81f1a83c57206f3774_JaffaCakes118
Size

731KB
Sample

240822-vhwhpsxhkb
MD5

b86b2f1514089c81f1a83c57206f3774
SHA1

cd171f46f4fc24e067898b9a24e3ad537c26047a
SHA256

1204d7ec8052f3985a67080420f32d8bbdada893340aa15fff05af23509d2a9c
SHA512

4ff9bfca3ef6ac80a1446b921573ec673470f87c48887bfa147a3ff7a1c53f7dc3e6424969baf39a317ade2b68bbd2297bd6a991db8606373df7cf0cfeaf51fa
SSDEEP

12288:bCpjBdYbmrjpNlARTHHxZ5rCpNmWPDgGeIttwoPR5pWZhAIRXHYnrm6:bCpFKbsGHHf5mpxPlFttwYQRXHYrm6

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  b86b2f1514089c81f1a83c57206f3774_JaffaCakes118
- Size
  
  731KB
- MD5
  
  b86b2f1514089c81f1a83c57206f3774
- SHA1
  
  cd171f46f4fc24e067898b9a24e3ad537c26047a
- SHA256
  
  1204d7ec8052f3985a67080420f32d8bbdada893340aa15fff05af23509d2a9c
- SHA512
  
  4ff9bfca3ef6ac80a1446b921573ec673470f87c48887bfa147a3ff7a1c53f7dc3e6424969baf39a317ade2b68bbd2297bd6a991db8606373df7cf0cfeaf51fa
- SSDEEP
  
  12288:bCpjBdYbmrjpNlARTHHxZ5rCpNmWPDgGeIttwoPR5pWZhAIRXHYnrm6:bCpFKbsGHHf5mpxPlFttwYQRXHYrm6
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation