c0d8d3bb47a03040905e3fa96972a53b87867582afdf0556db47183a1b7a1d15 | Triage

Sharing

General

Target

2a99b2e07132e7a7b432da34029f5046_JaffaCakes118
Size

702KB
Sample

240708-cfywyazble
MD5

2a99b2e07132e7a7b432da34029f5046
SHA1

b88c545b24c5bb7d208a82fc9ca51ea505c99d9b
SHA256

c0d8d3bb47a03040905e3fa96972a53b87867582afdf0556db47183a1b7a1d15
SHA512

0e79d804b9c821aedd0baded85e6d73293de64b651961dcaa589b5566bdea80772b03f63ea699b3e532cde2e9290712998940822371fc1ef1078160845472245
SSDEEP

12288:allmEbenvKvWvqUJQKxD0O3VRuWGK0YTA5xsGUczKGAi:4dbsRczgi

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  2a99b2e07132e7a7b432da34029f5046_JaffaCakes118
- Size
  
  702KB
- MD5
  
  2a99b2e07132e7a7b432da34029f5046
- SHA1
  
  b88c545b24c5bb7d208a82fc9ca51ea505c99d9b
- SHA256
  
  c0d8d3bb47a03040905e3fa96972a53b87867582afdf0556db47183a1b7a1d15
- SHA512
  
  0e79d804b9c821aedd0baded85e6d73293de64b651961dcaa589b5566bdea80772b03f63ea699b3e532cde2e9290712998940822371fc1ef1078160845472245
- SSDEEP
  
  12288:allmEbenvKvWvqUJQKxD0O3VRuWGK0YTA5xsGUczKGAi:4dbsRczgi
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation