3440c0d7c314ee056e46cae177989c4aea034362bbd3fedac721727afc1629fe | Triage

Sharing

General

Target

bec966bd84aae349b4943bafaa6a4dff_JaffaCakes118
Size

731KB
Sample

240824-rr253awdmq
MD5

bec966bd84aae349b4943bafaa6a4dff
SHA1

301c219564d08abbc9cb777b6c313931a09157af
SHA256

3440c0d7c314ee056e46cae177989c4aea034362bbd3fedac721727afc1629fe
SHA512

26a229fbca499e100f73c6c5f5f265c65aaaa842bd1b7cbf9c509448cf3c7196c60518514095d8d616100b26ac413f22b47e79f4efb72379d4fd036d5232fefc
SSDEEP

12288:Jaingtd/9iCpVEZxzraxdUdpmcFmjnDgGeIttwoPR5pWZhAIRXHYnrmA:JaigD/ArravUdscwnlFttwYQRXHYrmA

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  bec966bd84aae349b4943bafaa6a4dff_JaffaCakes118
- Size
  
  731KB
- MD5
  
  bec966bd84aae349b4943bafaa6a4dff
- SHA1
  
  301c219564d08abbc9cb777b6c313931a09157af
- SHA256
  
  3440c0d7c314ee056e46cae177989c4aea034362bbd3fedac721727afc1629fe
- SHA512
  
  26a229fbca499e100f73c6c5f5f265c65aaaa842bd1b7cbf9c509448cf3c7196c60518514095d8d616100b26ac413f22b47e79f4efb72379d4fd036d5232fefc
- SSDEEP
  
  12288:Jaingtd/9iCpVEZxzraxdUdpmcFmjnDgGeIttwoPR5pWZhAIRXHYnrmA:JaigD/ArravUdscwnlFttwYQRXHYrmA
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation