7c5d40bb5b9a75f81a229f3ac3dd9703c26e9ecfe675939b0fa5309485557a7f | Triage

Sharing

General

Target

03e0b52b1c8f70d3df79464c7580f3e6_JaffaCakes118
Size

204KB
Sample

240620-hwkl5szclr
MD5

03e0b52b1c8f70d3df79464c7580f3e6
SHA1

c495f67fca299f2cf5f0a9a871dded156f0e4087
SHA256

7c5d40bb5b9a75f81a229f3ac3dd9703c26e9ecfe675939b0fa5309485557a7f
SHA512

1c3fe6b8b8d3bf60b6538e544124105be7d7d69d21802143c09a51eb7ebdb22c1a9892d8641b89424bc082e15cdc760aa09665366a0d9cf2d1e20b4f03cc926f
SSDEEP

3072:rw3FkTX3vHjw07AkuwI1U4BxoT6u0RhKoU0/YAQ17B5XzLxWkTcCmsc2W91:reknvDfuXu2K90/YbFHDtWum91

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  03e0b52b1c8f70d3df79464c7580f3e6_JaffaCakes118
- Size
  
  204KB
- MD5
  
  03e0b52b1c8f70d3df79464c7580f3e6
- SHA1
  
  c495f67fca299f2cf5f0a9a871dded156f0e4087
- SHA256
  
  7c5d40bb5b9a75f81a229f3ac3dd9703c26e9ecfe675939b0fa5309485557a7f
- SHA512
  
  1c3fe6b8b8d3bf60b6538e544124105be7d7d69d21802143c09a51eb7ebdb22c1a9892d8641b89424bc082e15cdc760aa09665366a0d9cf2d1e20b4f03cc926f
- SSDEEP
  
  3072:rw3FkTX3vHjw07AkuwI1U4BxoT6u0RhKoU0/YAQ17B5XzLxWkTcCmsc2W91:reknvDfuXu2K90/YbFHDtWum91
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation