Overview

overview

10

Static

static

3

002b41ba32...18.dll

windows7-x64

10

002b41ba32...18.dll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    002b41ba320fd3c7d4b507d6f7d7c6a7_JaffaCakes118

  • Size

    23KB

  • Sample

    240619-ybj3waycmc

  • MD5

    002b41ba320fd3c7d4b507d6f7d7c6a7

  • SHA1

    4a559139844693f87a743fb49f31a9544d788b89

  • SHA256

    9958937d6aff0aa4d0ff21d1f552a5b852d8f12795f0f628a6842af9a2196792

  • SHA512

    5fc512eede3408cea4fcd8945d2849554e9b33a0451c1d488204bca3f92524c949e1fde6ee487b32ebb8c6588b2de7e6eecdf9cacf87c7f2850725ca67c6f673

  • SSDEEP

    384:UidD9d6GA2ywjeILOMESQsAqV4kspGlZ5NqWQKaK94ySyUgIjosE2ozEclAL6di:hW6ekwrqTDz5NquBqosE2oEcVI

Score
10/10
evasionpersistenceprivilege_escalation

Malware Config

Targets

    • Target

      002b41ba320fd3c7d4b507d6f7d7c6a7_JaffaCakes118

    • Size

      23KB

    • MD5

      002b41ba320fd3c7d4b507d6f7d7c6a7

    • SHA1

      4a559139844693f87a743fb49f31a9544d788b89

    • SHA256

      9958937d6aff0aa4d0ff21d1f552a5b852d8f12795f0f628a6842af9a2196792

    • SHA512

      5fc512eede3408cea4fcd8945d2849554e9b33a0451c1d488204bca3f92524c949e1fde6ee487b32ebb8c6588b2de7e6eecdf9cacf87c7f2850725ca67c6f673

    • SSDEEP

      384:UidD9d6GA2ywjeILOMESQsAqV4kspGlZ5NqWQKaK94ySyUgIjosE2ozEclAL6di:hW6ekwrqTDz5NquBqosE2oEcVI

    Score
    10/10
    evasionpersistenceprivilege_escalation

    • Modifies firewall policy service

      evasion

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks