303a9083457e47d857882825d4964982bdf02563383490f2704cc165ab2a6164 | Triage

Sharing

General

Target

c873297682ade13292f6630a612b6e4f_JaffaCakes118
Size

758B
Sample

240829-jjaf3szere
MD5

c873297682ade13292f6630a612b6e4f
SHA1

a0ccfe79d08164cf346d1eb3e6b1f4a21ab34e5d
SHA256

303a9083457e47d857882825d4964982bdf02563383490f2704cc165ab2a6164
SHA512

02237291150d94743c47465754fb86342d4ece0ce996ed24502b191e68063a75884b6f36be2075ebc838d5300adb183c238cc9a6a55239bcc340b7f39901e035

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  c873297682ade13292f6630a612b6e4f_JaffaCakes118
- Size
  
  758B
- MD5
  
  c873297682ade13292f6630a612b6e4f
- SHA1
  
  a0ccfe79d08164cf346d1eb3e6b1f4a21ab34e5d
- SHA256
  
  303a9083457e47d857882825d4964982bdf02563383490f2704cc165ab2a6164
- SHA512
  
  02237291150d94743c47465754fb86342d4ece0ce996ed24502b191e68063a75884b6f36be2075ebc838d5300adb183c238cc9a6a55239bcc340b7f39901e035
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation