c38119da55a55d5547f26203e6287da352a47aef28c9ac389433a1d402917f1f | Triage

Sharing

General

Target

c22ff0d21ea25db77a972b119fd8b047_JaffaCakes118
Size

728KB
Sample

240826-dyk88stelm
MD5

c22ff0d21ea25db77a972b119fd8b047
SHA1

e88397639c4c07b6e68a74d987f24e300f95d1ee
SHA256

c38119da55a55d5547f26203e6287da352a47aef28c9ac389433a1d402917f1f
SHA512

5b6b5591b00a325164ebf3f026b31a20985133ede5d275954c558aaa3b3a000f9f997ecad362fa0bd30f8384f569e5e33fe34da3ae85046a6ba55a7ca32058e5
SSDEEP

12288:lEcF8D2K53tGcAOYYsLN2Z8bbXD/meGDgGeItoEc9GspWZhASRXHYnrm9:lEc8H5fMLN2Kb7DrGlFtov9GsqRXHYrC

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  c22ff0d21ea25db77a972b119fd8b047_JaffaCakes118
- Size
  
  728KB
- MD5
  
  c22ff0d21ea25db77a972b119fd8b047
- SHA1
  
  e88397639c4c07b6e68a74d987f24e300f95d1ee
- SHA256
  
  c38119da55a55d5547f26203e6287da352a47aef28c9ac389433a1d402917f1f
- SHA512
  
  5b6b5591b00a325164ebf3f026b31a20985133ede5d275954c558aaa3b3a000f9f997ecad362fa0bd30f8384f569e5e33fe34da3ae85046a6ba55a7ca32058e5
- SSDEEP
  
  12288:lEcF8D2K53tGcAOYYsLN2Z8bbXD/meGDgGeItoEc9GspWZhASRXHYnrm9:lEc8H5fMLN2Kb7DrGlFtov9GsqRXHYrC
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation