e3743230df8b4442f71d8d679e218a9b6f8569387d273a57ef02fd2dd3dd315a | Triage

Sharing

General

Target

eaabe0f0dff7c28a08a257ba3f16b004_JaffaCakes118
Size

728KB
Sample

240919-f5972stbjm
MD5

eaabe0f0dff7c28a08a257ba3f16b004
SHA1

d5154524d883a37c94342d7bc9a3753026182568
SHA256

e3743230df8b4442f71d8d679e218a9b6f8569387d273a57ef02fd2dd3dd315a
SHA512

2b3eb256cb1918bf45d6425fb1b8af52c35aff7287577576d96fc3b5fe1e186ce3208577c01b202068ade93875ee9eb9bf4c4883d567d8a07c6cb61abca3fe86
SSDEEP

12288:lEcF8D2K53tGcAOYYsLN2Z8bbXc/meGDgGeItoEc9GspWZhASRXHYnrmk:lEc8H5fMLN2Kb7crGlFtov9GsqRXHYrP

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  eaabe0f0dff7c28a08a257ba3f16b004_JaffaCakes118
- Size
  
  728KB
- MD5
  
  eaabe0f0dff7c28a08a257ba3f16b004
- SHA1
  
  d5154524d883a37c94342d7bc9a3753026182568
- SHA256
  
  e3743230df8b4442f71d8d679e218a9b6f8569387d273a57ef02fd2dd3dd315a
- SHA512
  
  2b3eb256cb1918bf45d6425fb1b8af52c35aff7287577576d96fc3b5fe1e186ce3208577c01b202068ade93875ee9eb9bf4c4883d567d8a07c6cb61abca3fe86
- SSDEEP
  
  12288:lEcF8D2K53tGcAOYYsLN2Z8bbXc/meGDgGeItoEc9GspWZhASRXHYnrmk:lEc8H5fMLN2Kb7crGlFtov9GsqRXHYrP
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation