051a4237e1e67b6da44caa567802224b39b0dd2ef8015522b7d8112344b9a98b | Triage

Sharing

General

Target

c0fefc0af7cb898937c279126c8e3655_JaffaCakes118
Size

728KB
Sample

240825-sha6nasbpn
MD5

c0fefc0af7cb898937c279126c8e3655
SHA1

ae2eb776d28084bb72205ff7157a11dc0e2a8dd0
SHA256

051a4237e1e67b6da44caa567802224b39b0dd2ef8015522b7d8112344b9a98b
SHA512

d91ee9d65ad4d06fc7cbfb289894c2ed1bd051cd425ea8279fa5150db5fbb1de5e42457da0b1c2adc99325d2f0776d472dfac065842fea66bc599640575bf56f
SSDEEP

12288:lEcF8D2K53tGcAOYYsLN2Z8bbXF/meGDgGeItoEc9GspWZhASRXHYnrmK:lEc8H5fMLN2Kb7FrGlFtov9GsqRXHYrB

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  c0fefc0af7cb898937c279126c8e3655_JaffaCakes118
- Size
  
  728KB
- MD5
  
  c0fefc0af7cb898937c279126c8e3655
- SHA1
  
  ae2eb776d28084bb72205ff7157a11dc0e2a8dd0
- SHA256
  
  051a4237e1e67b6da44caa567802224b39b0dd2ef8015522b7d8112344b9a98b
- SHA512
  
  d91ee9d65ad4d06fc7cbfb289894c2ed1bd051cd425ea8279fa5150db5fbb1de5e42457da0b1c2adc99325d2f0776d472dfac065842fea66bc599640575bf56f
- SSDEEP
  
  12288:lEcF8D2K53tGcAOYYsLN2Z8bbXF/meGDgGeItoEc9GspWZhASRXHYnrmK:lEc8H5fMLN2Kb7FrGlFtov9GsqRXHYrB
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation