ae8ec96878d441551a8b9eb137c99e98cc606ee8ea8e1ca2dcda512df46cf438 | Triage

Sharing

General

Target

bd6cda0a8e00eebfbb5a8ee48dbba142_JaffaCakes118
Size

734KB
Sample

240823-2grlpashkr
MD5

bd6cda0a8e00eebfbb5a8ee48dbba142
SHA1

99bd0411b9b95c455b63c4e4557c16b108a5ab12
SHA256

ae8ec96878d441551a8b9eb137c99e98cc606ee8ea8e1ca2dcda512df46cf438
SHA512

0af6c33edd4b76e5a760bd91a43636ad243da916c4d93b449f50db1141f218d6a3931bb9e413ae7e5de2628a470a9663eb0cd577acab9e3a604907ef88bfe013
SSDEEP

12288:bkZMrKuT9eES2EGfKMlAvDuicrvX7KmtKDgGeIttwoPR5pWZhAIRXHYnrmJ:bkZCXTqjMWvVcLX7xKlFttwYQRXHYrmJ

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  bd6cda0a8e00eebfbb5a8ee48dbba142_JaffaCakes118
- Size
  
  734KB
- MD5
  
  bd6cda0a8e00eebfbb5a8ee48dbba142
- SHA1
  
  99bd0411b9b95c455b63c4e4557c16b108a5ab12
- SHA256
  
  ae8ec96878d441551a8b9eb137c99e98cc606ee8ea8e1ca2dcda512df46cf438
- SHA512
  
  0af6c33edd4b76e5a760bd91a43636ad243da916c4d93b449f50db1141f218d6a3931bb9e413ae7e5de2628a470a9663eb0cd577acab9e3a604907ef88bfe013
- SSDEEP
  
  12288:bkZMrKuT9eES2EGfKMlAvDuicrvX7KmtKDgGeIttwoPR5pWZhAIRXHYnrmJ:bkZCXTqjMWvVcLX7xKlFttwYQRXHYrmJ
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation