f3d18451c7d46218a8575931131272ea3789787f09d5174d97e270db4512c93e | Triage

Sharing

General

Target

0e2b774ae436ccbed68094cdafb2a4e2_JaffaCakes118
Size

98KB
Sample

240625-p889la1ela
MD5

0e2b774ae436ccbed68094cdafb2a4e2
SHA1

85ff332a041ea1f32dbea92403b92c7c0773143d
SHA256

f3d18451c7d46218a8575931131272ea3789787f09d5174d97e270db4512c93e
SHA512

31cd5bec68275d476e8c71c7f4d16bd1c660754db90b9fc019b8f25a03763078c12732b3c498b128ed4690800f91e461caf4b0b042b70abadad6a6d91bb2bb94
SSDEEP

1536:GCmqdgiJvXTbGyx7/ggRYJJnbZfxtt1V1yfm0jLxxayPIDACBWm5+/jnpRG7AAL6:1rvXTS47/rRYrn1R70fxrAclpqxH0Z

Score

8^/10

persistence privilege_escalation

Malware Config

Targets

- Target
  
  0e2b774ae436ccbed68094cdafb2a4e2_JaffaCakes118
- Size
  
  98KB
- MD5
  
  0e2b774ae436ccbed68094cdafb2a4e2
- SHA1
  
  85ff332a041ea1f32dbea92403b92c7c0773143d
- SHA256
  
  f3d18451c7d46218a8575931131272ea3789787f09d5174d97e270db4512c93e
- SHA512
  
  31cd5bec68275d476e8c71c7f4d16bd1c660754db90b9fc019b8f25a03763078c12732b3c498b128ed4690800f91e461caf4b0b042b70abadad6a6d91bb2bb94
- SSDEEP
  
  1536:GCmqdgiJvXTbGyx7/ggRYJJnbZfxtt1V1yfm0jLxxayPIDACBWm5+/jnpRG7AAL6:1rvXTS47/rRYrn1R70fxrAclpqxH0Z
Score

8^/10

persistence privilege_escalation
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

AppInit DLLs

Privilege Escalation

Event Triggered Execution

AppInit DLLs

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistenceprivilege_escalation

behavioral2