e5804ac65900c42b4c4cfc658170c8dc38c81b5952077d3f818a20c229fee40c | Triage

Sharing

General

Target

d0fdbef928982e62587c26ac2b7707f9_JaffaCakes118
Size

728KB
Sample

240907-d5a2vasgnl
MD5

d0fdbef928982e62587c26ac2b7707f9
SHA1

94e88b142ac8fad8e8772a5cad4fae762f81c169
SHA256

e5804ac65900c42b4c4cfc658170c8dc38c81b5952077d3f818a20c229fee40c
SHA512

2f07da6277e07d52148071ac09f605b5eebf2ff2376332f526d12a0bfb9450fe1caa2c07066dffe1db57a178f3f69e8b3f16f712b281dacd1a67fc4088bc9e1a
SSDEEP

12288:z2/I3CMZC4u8YBbY5zgHWHmt8qM3mmcKDgGeItoEc9GspWZhASRXHYnrm1:z2QSmCrmgHCmKqM3kKlFtov9GsqRXHYm

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  d0fdbef928982e62587c26ac2b7707f9_JaffaCakes118
- Size
  
  728KB
- MD5
  
  d0fdbef928982e62587c26ac2b7707f9
- SHA1
  
  94e88b142ac8fad8e8772a5cad4fae762f81c169
- SHA256
  
  e5804ac65900c42b4c4cfc658170c8dc38c81b5952077d3f818a20c229fee40c
- SHA512
  
  2f07da6277e07d52148071ac09f605b5eebf2ff2376332f526d12a0bfb9450fe1caa2c07066dffe1db57a178f3f69e8b3f16f712b281dacd1a67fc4088bc9e1a
- SSDEEP
  
  12288:z2/I3CMZC4u8YBbY5zgHWHmt8qM3mmcKDgGeItoEc9GspWZhASRXHYnrm1:z2QSmCrmgHCmKqM3kKlFtov9GsqRXHYm
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation