173a3a7013e3d18e60a6c00b3e040251ad1779ac701c6c82b2393b1176cef5cf | Triage

Sharing

General

Target

e23c2d806a9932eec4cfdf797407fd61_JaffaCakes118
Size

733KB
Sample

240915-l7lv5aybjf
MD5

e23c2d806a9932eec4cfdf797407fd61
SHA1

67ad9448959b00b6e14f82b366041bbedf9297d2
SHA256

173a3a7013e3d18e60a6c00b3e040251ad1779ac701c6c82b2393b1176cef5cf
SHA512

b2c8bb9bcd1d1048a3681936d4b4f0e4ef942494f8da67f80c4d888804009cb7711aa64d9d29ae23ad92eeac08f3403c8836206ed2c80461e442617a2951e73a
SSDEEP

12288:13Fpj4rBRLukn+zKg2oOR2OQl5ZAdmxQDgGeItGBV07XpWZhASRXHYnrmY:1VpUFRUgoOwOY5ZAqQlFtWVAqRXHYrmY

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  e23c2d806a9932eec4cfdf797407fd61_JaffaCakes118
- Size
  
  733KB
- MD5
  
  e23c2d806a9932eec4cfdf797407fd61
- SHA1
  
  67ad9448959b00b6e14f82b366041bbedf9297d2
- SHA256
  
  173a3a7013e3d18e60a6c00b3e040251ad1779ac701c6c82b2393b1176cef5cf
- SHA512
  
  b2c8bb9bcd1d1048a3681936d4b4f0e4ef942494f8da67f80c4d888804009cb7711aa64d9d29ae23ad92eeac08f3403c8836206ed2c80461e442617a2951e73a
- SSDEEP
  
  12288:13Fpj4rBRLukn+zKg2oOR2OQl5ZAdmxQDgGeItGBV07XpWZhASRXHYnrmY:1VpUFRUgoOwOY5ZAqQlFtWVAqRXHYrmY
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation