108d973ede148d1050c86536fc58a608ee9b281188347d002bb7f7bf15624350 | Triage

Sharing

General

Target

c7c1c740e94e5592dac0baf1fd2b5bd8_JaffaCakes118
Size

728KB
Sample

240828-2b3rrszblf
MD5

c7c1c740e94e5592dac0baf1fd2b5bd8
SHA1

0134073338936a1c4331b60ea250143b2ba5e0e4
SHA256

108d973ede148d1050c86536fc58a608ee9b281188347d002bb7f7bf15624350
SHA512

9af8f5d2f60d32696debfa6ddee451605f155c5ae027aac5f8747e2d5f290ac50ff51617c0501c637f08bbc98de7d14c1892cbae0b6a544015fbce8d6086514d
SSDEEP

12288:lEcF8D2K53tGcAOYYsLN2Z8bbXU/meGDgGeItoEc9GspWZhASRXHYnrmB:lEc8H5fMLN2Kb7UrGlFtov9GsqRXHYr2

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  c7c1c740e94e5592dac0baf1fd2b5bd8_JaffaCakes118
- Size
  
  728KB
- MD5
  
  c7c1c740e94e5592dac0baf1fd2b5bd8
- SHA1
  
  0134073338936a1c4331b60ea250143b2ba5e0e4
- SHA256
  
  108d973ede148d1050c86536fc58a608ee9b281188347d002bb7f7bf15624350
- SHA512
  
  9af8f5d2f60d32696debfa6ddee451605f155c5ae027aac5f8747e2d5f290ac50ff51617c0501c637f08bbc98de7d14c1892cbae0b6a544015fbce8d6086514d
- SSDEEP
  
  12288:lEcF8D2K53tGcAOYYsLN2Z8bbXU/meGDgGeItoEc9GspWZhASRXHYnrmB:lEc8H5fMLN2Kb7UrGlFtov9GsqRXHYr2
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation