fcaf1604c53e9ee4989eddcf544a68fd9875c6eb14da65ba5be6488f8f05ed3e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fc2a38bf8bd82e7e76aac0f1172c9c6d_JaffaCakes118
Size

728KB
Sample

240928-m5y84sscqn
MD5

fc2a38bf8bd82e7e76aac0f1172c9c6d
SHA1

3939457b4299440b4df24379bd00ad8a824eed78
SHA256

fcaf1604c53e9ee4989eddcf544a68fd9875c6eb14da65ba5be6488f8f05ed3e
SHA512

a49ceeece0ec37faa9bd2cc4efb271fc4d1a723f4c95045fedc5a377b6e8c36ee29d217aad02f945e87ac58bbb96a15b2712ec20290a62e48c6ed6618ddaec52
SSDEEP

12288:z2/I3CMZC4u8YBbY5zgHWHmt8qMTmmcKDgGeItoEc9GspWZhASRXHYnrmk:z2QSmCrmgHCmKqMTkKlFtov9GsqRXHYr

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  fc2a38bf8bd82e7e76aac0f1172c9c6d_JaffaCakes118
- Size
  
  728KB
- MD5
  
  fc2a38bf8bd82e7e76aac0f1172c9c6d
- SHA1
  
  3939457b4299440b4df24379bd00ad8a824eed78
- SHA256
  
  fcaf1604c53e9ee4989eddcf544a68fd9875c6eb14da65ba5be6488f8f05ed3e
- SHA512
  
  a49ceeece0ec37faa9bd2cc4efb271fc4d1a723f4c95045fedc5a377b6e8c36ee29d217aad02f945e87ac58bbb96a15b2712ec20290a62e48c6ed6618ddaec52
- SSDEEP
  
  12288:z2/I3CMZC4u8YBbY5zgHWHmt8qMTmmcKDgGeItoEc9GspWZhASRXHYnrmk:z2QSmCrmgHCmKqMTkKlFtov9GsqRXHYr
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation