dc0cc506778b50e955b1ce70812f73f124072ecfd6184ae04a4c2e09eb6b3ce5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c8d06fff5e36dfcb3630cd34bbffee84_JaffaCakes118
Size

728KB
Sample

240829-plr2ss1epd
MD5

c8d06fff5e36dfcb3630cd34bbffee84
SHA1

55aa576af57d0fb142fdbfb8fc9000d6bcf79687
SHA256

dc0cc506778b50e955b1ce70812f73f124072ecfd6184ae04a4c2e09eb6b3ce5
SHA512

66406e6ddfff57d615d3a139d84717ab736a2defceab107e93eb08ec2c95409c64828a010772d8a61a760b36f5896f871d16a89621358bd4294c8c8a89486a88
SSDEEP

12288:lEcF8D2K53tGcAOYYsLN2Z8bbXz/meGDgGeItoEc9GspWZhASRXHYnrmf:lEc8H5fMLN2Kb7zrGlFtov9GsqRXHYr4

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  c8d06fff5e36dfcb3630cd34bbffee84_JaffaCakes118
- Size
  
  728KB
- MD5
  
  c8d06fff5e36dfcb3630cd34bbffee84
- SHA1
  
  55aa576af57d0fb142fdbfb8fc9000d6bcf79687
- SHA256
  
  dc0cc506778b50e955b1ce70812f73f124072ecfd6184ae04a4c2e09eb6b3ce5
- SHA512
  
  66406e6ddfff57d615d3a139d84717ab736a2defceab107e93eb08ec2c95409c64828a010772d8a61a760b36f5896f871d16a89621358bd4294c8c8a89486a88
- SSDEEP
  
  12288:lEcF8D2K53tGcAOYYsLN2Z8bbXz/meGDgGeItoEc9GspWZhASRXHYnrmf:lEc8H5fMLN2Kb7zrGlFtov9GsqRXHYr4
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation