21ee36fb172eb2e272b56244eada54b1b0baaf96a216f695c3ccd3fa31c3eb32 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dcbeaff7c70b1fbd0ed3f2c43ae00fcd_JaffaCakes118
Size

734KB
Sample

240912-wev87swena
MD5

dcbeaff7c70b1fbd0ed3f2c43ae00fcd
SHA1

402788ff236a0aa71e06185c66764b119ab0d33e
SHA256

21ee36fb172eb2e272b56244eada54b1b0baaf96a216f695c3ccd3fa31c3eb32
SHA512

ad053cf09e7a31fce03b7d78f7507c06d32c1a57f5b1b0ef3b2a50744df06dad0df974d343953af34f35aebdee0315ef0ecd89f7634e63b54529b6773093e1a4
SSDEEP

12288:bkZMrKuT9eES2EGfKMlAvDuicrvXxKmtKDgGeIttwoPR5pWZhAIRXHYnrmt:bkZCXTqjMWvVcLXxxKlFttwYQRXHYrmt

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  dcbeaff7c70b1fbd0ed3f2c43ae00fcd_JaffaCakes118
- Size
  
  734KB
- MD5
  
  dcbeaff7c70b1fbd0ed3f2c43ae00fcd
- SHA1
  
  402788ff236a0aa71e06185c66764b119ab0d33e
- SHA256
  
  21ee36fb172eb2e272b56244eada54b1b0baaf96a216f695c3ccd3fa31c3eb32
- SHA512
  
  ad053cf09e7a31fce03b7d78f7507c06d32c1a57f5b1b0ef3b2a50744df06dad0df974d343953af34f35aebdee0315ef0ecd89f7634e63b54529b6773093e1a4
- SSDEEP
  
  12288:bkZMrKuT9eES2EGfKMlAvDuicrvXxKmtKDgGeIttwoPR5pWZhAIRXHYnrmt:bkZCXTqjMWvVcLXxxKlFttwYQRXHYrmt
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation