1d05504995ed7193b9998fba7a28d961f5709ba8a202b2fd78008edff672ac90 | Triage

Sharing

General

Target

c93f5d0f19caaccf3d1450ea21b5a723_JaffaCakes118
Size

728KB
Sample

240829-vk5t6asarg
MD5

c93f5d0f19caaccf3d1450ea21b5a723
SHA1

3b884f7eacbaedbe82bc9eb6ad906fe849bccced
SHA256

1d05504995ed7193b9998fba7a28d961f5709ba8a202b2fd78008edff672ac90
SHA512

e8c9d321a7d04a1f28d349dc673c3123f35662746c2dc00ca2975fea9e4e55b3809615e072959c5bf3eb36fa6301adab4a9234a967bdc68263a66c3989250f04
SSDEEP

12288:lEcF8D2K53tGcAOYYsLN2Z8bbX3/meGDgGeItoEc9GspWZhASRXHYnrm1:lEc8H5fMLN2Kb73rGlFtov9GsqRXHYr2

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  c93f5d0f19caaccf3d1450ea21b5a723_JaffaCakes118
- Size
  
  728KB
- MD5
  
  c93f5d0f19caaccf3d1450ea21b5a723
- SHA1
  
  3b884f7eacbaedbe82bc9eb6ad906fe849bccced
- SHA256
  
  1d05504995ed7193b9998fba7a28d961f5709ba8a202b2fd78008edff672ac90
- SHA512
  
  e8c9d321a7d04a1f28d349dc673c3123f35662746c2dc00ca2975fea9e4e55b3809615e072959c5bf3eb36fa6301adab4a9234a967bdc68263a66c3989250f04
- SSDEEP
  
  12288:lEcF8D2K53tGcAOYYsLN2Z8bbX3/meGDgGeItoEc9GspWZhASRXHYnrm1:lEc8H5fMLN2Kb73rGlFtov9GsqRXHYr2
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation