0b5edb524e09bb0baaaa7df49515755ca19794021a9a22e237fbdc9973eb18fe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

169f0a29822acd6e372664d7b2452da0_JaffaCakes118
Size

36KB
Sample

240627-tf4wmayfjb
MD5

169f0a29822acd6e372664d7b2452da0
SHA1

2faffc2ab694fd0139086d81fb9ec17c31188ac3
SHA256

0b5edb524e09bb0baaaa7df49515755ca19794021a9a22e237fbdc9973eb18fe
SHA512

f99ce9230b5933f8d32f786ba92bab9e84d86ad11f23551d14acc4c634aad245f23ca75cd59bf8d41d13405435e1347b0a2ae4791c67ba49cd43274a85adacec
SSDEEP

768:tfZ2YidJN5kXcyXrCD1tDMByGqnxGm3+IdW:tedEcyXrC/GsnsGdW

Score

8^/10

persistence privilege_escalation

Malware Config

Targets

- Target
  
  169f0a29822acd6e372664d7b2452da0_JaffaCakes118
- Size
  
  36KB
- MD5
  
  169f0a29822acd6e372664d7b2452da0
- SHA1
  
  2faffc2ab694fd0139086d81fb9ec17c31188ac3
- SHA256
  
  0b5edb524e09bb0baaaa7df49515755ca19794021a9a22e237fbdc9973eb18fe
- SHA512
  
  f99ce9230b5933f8d32f786ba92bab9e84d86ad11f23551d14acc4c634aad245f23ca75cd59bf8d41d13405435e1347b0a2ae4791c67ba49cd43274a85adacec
- SSDEEP
  
  768:tfZ2YidJN5kXcyXrCD1tDMByGqnxGm3+IdW:tedEcyXrC/GsnsGdW
Score

8^/10

persistence privilege_escalation
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

AppInit DLLs

Privilege Escalation

Event Triggered Execution

AppInit DLLs

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistenceprivilege_escalation

behavioral2

persistenceprivilege_escalation