f1c9ea1fbc94b5d8e1e530f97feb6e5f5a52453dd7beea0e99e0df56c58ee0b3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

be665809631cb952d7c4133496663220_JaffaCakes118
Size

728KB
Sample

240824-mg91pswakd
MD5

be665809631cb952d7c4133496663220
SHA1

56c062f173c36d2dfd40413726aaac521c67bf70
SHA256

f1c9ea1fbc94b5d8e1e530f97feb6e5f5a52453dd7beea0e99e0df56c58ee0b3
SHA512

3f32924be56f379921833cf5a10772419e8895523c79cecba1a6fbbece404647c6badfc5b44501723cc175b3768c03fb3462f3da973026ab7f949158dd843a23
SSDEEP

12288:lEcF8D2K53tGcAOYYsLN2Z8bbXH/meGDgGeItoEc9GspWZhASRXHYnrmj:lEc8H5fMLN2Kb7HrGlFtov9GsqRXHYr8

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  be665809631cb952d7c4133496663220_JaffaCakes118
- Size
  
  728KB
- MD5
  
  be665809631cb952d7c4133496663220
- SHA1
  
  56c062f173c36d2dfd40413726aaac521c67bf70
- SHA256
  
  f1c9ea1fbc94b5d8e1e530f97feb6e5f5a52453dd7beea0e99e0df56c58ee0b3
- SHA512
  
  3f32924be56f379921833cf5a10772419e8895523c79cecba1a6fbbece404647c6badfc5b44501723cc175b3768c03fb3462f3da973026ab7f949158dd843a23
- SSDEEP
  
  12288:lEcF8D2K53tGcAOYYsLN2Z8bbXH/meGDgGeItoEc9GspWZhASRXHYnrmj:lEc8H5fMLN2Kb7HrGlFtov9GsqRXHYr8
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation