b91bcb94d966b14ad2858834974cca63e3033f5d1f8c9bc3c50a5b87eed9c851 | Triage

Sharing

General

Target

f9dacb74ed85f7c07d4754527f0987d8_JaffaCakes118
Size

733KB
Sample

240927-grsxaaybrn
MD5

f9dacb74ed85f7c07d4754527f0987d8
SHA1

74a05b5c790129b5f2e04d6ec2e0fe9a1ea2f25c
SHA256

b91bcb94d966b14ad2858834974cca63e3033f5d1f8c9bc3c50a5b87eed9c851
SHA512

8b3a40731ee9e2b25f97e25c492bc0472c66f2de895a4f5f62409a4102aff3135d425644922fe281a6acd59be9d6be23f03eb929a86ccf708eb5ebfb19776dee
SSDEEP

12288:13Fpj4rBRLukn+zKg2oOR2OQl5QAdmxQDgGeItGBV07XpWZhASRXHYnrm2:1VpUFRUgoOwOY5QAqQlFtWVAqRXHYrm2

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  f9dacb74ed85f7c07d4754527f0987d8_JaffaCakes118
- Size
  
  733KB
- MD5
  
  f9dacb74ed85f7c07d4754527f0987d8
- SHA1
  
  74a05b5c790129b5f2e04d6ec2e0fe9a1ea2f25c
- SHA256
  
  b91bcb94d966b14ad2858834974cca63e3033f5d1f8c9bc3c50a5b87eed9c851
- SHA512
  
  8b3a40731ee9e2b25f97e25c492bc0472c66f2de895a4f5f62409a4102aff3135d425644922fe281a6acd59be9d6be23f03eb929a86ccf708eb5ebfb19776dee
- SSDEEP
  
  12288:13Fpj4rBRLukn+zKg2oOR2OQl5QAdmxQDgGeItGBV07XpWZhASRXHYnrm2:1VpUFRUgoOwOY5QAqQlFtWVAqRXHYrm2
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation