cc9097207ef76b80fdb91d1e9428012bf405360de4383e87b3d4e18d58c9002d | Triage

Sharing

General

Target

fd575edfeb16fb232e226e6bd753bb75_JaffaCakes118
Size

728KB
Sample

240928-297tdazhmp
MD5

fd575edfeb16fb232e226e6bd753bb75
SHA1

a399ee49efb8d4ec0cc6535ced3c7f10130d42a1
SHA256

cc9097207ef76b80fdb91d1e9428012bf405360de4383e87b3d4e18d58c9002d
SHA512

797f1dfd0922e190cb8f5c174e7e08e783058b14187fc3a83e88c7805b1e8968b5f79868799a7eda3b8183cddb3c102245def93e80c3242eb54747480b920f5a
SSDEEP

12288:lEcF8D2K53tGcAOYYsLN2Z8bbX7/meGDgGeItoEc9GspWZhASRXHYnrmh:lEc8H5fMLN2Kb77rGlFtov9GsqRXHYrm

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  fd575edfeb16fb232e226e6bd753bb75_JaffaCakes118
- Size
  
  728KB
- MD5
  
  fd575edfeb16fb232e226e6bd753bb75
- SHA1
  
  a399ee49efb8d4ec0cc6535ced3c7f10130d42a1
- SHA256
  
  cc9097207ef76b80fdb91d1e9428012bf405360de4383e87b3d4e18d58c9002d
- SHA512
  
  797f1dfd0922e190cb8f5c174e7e08e783058b14187fc3a83e88c7805b1e8968b5f79868799a7eda3b8183cddb3c102245def93e80c3242eb54747480b920f5a
- SSDEEP
  
  12288:lEcF8D2K53tGcAOYYsLN2Z8bbX7/meGDgGeItoEc9GspWZhASRXHYnrmh:lEc8H5fMLN2Kb77rGlFtov9GsqRXHYrm
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation