b939cc07d1496f01db3298701f66ee6ac3d991d1b795e735d9f6d39ed1947d4c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2ff3d54720e9f7c5353fb24b943d3a13_JaffaCakes118
Size

36KB
Sample

240709-l735ea1bre
MD5

2ff3d54720e9f7c5353fb24b943d3a13
SHA1

8a03d3dede2d6dd8dfc395272d0a6515b4dfef35
SHA256

b939cc07d1496f01db3298701f66ee6ac3d991d1b795e735d9f6d39ed1947d4c
SHA512

2ae6d2b6f25991d7f3830bd49d06923268169769b92b76f9396c3f432e5d6ad9a4aab24700ff6cb2104ee793b540610fbd3c2bac8c442d1033f677c976272d04
SSDEEP

768:IfZd8dJN5kXcyXrCD1tDMByGqnxGm3+2VWSaLW:IQdEcyXrC/GsnsIVWSaLW

Score

8^/10

persistence privilege_escalation

Malware Config

Targets

- Target
  
  2ff3d54720e9f7c5353fb24b943d3a13_JaffaCakes118
- Size
  
  36KB
- MD5
  
  2ff3d54720e9f7c5353fb24b943d3a13
- SHA1
  
  8a03d3dede2d6dd8dfc395272d0a6515b4dfef35
- SHA256
  
  b939cc07d1496f01db3298701f66ee6ac3d991d1b795e735d9f6d39ed1947d4c
- SHA512
  
  2ae6d2b6f25991d7f3830bd49d06923268169769b92b76f9396c3f432e5d6ad9a4aab24700ff6cb2104ee793b540610fbd3c2bac8c442d1033f677c976272d04
- SSDEEP
  
  768:IfZd8dJN5kXcyXrCD1tDMByGqnxGm3+2VWSaLW:IQdEcyXrC/GsnsIVWSaLW
Score

8^/10

persistence privilege_escalation
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

AppInit DLLs

Privilege Escalation

Event Triggered Execution

AppInit DLLs

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistenceprivilege_escalation

behavioral2

persistenceprivilege_escalation