c9774645baeb52dc8f3486715fa744b4f57c8704e0d969bd60c6779fba06bde3 | Triage

Sharing

General

Target

2fdaab626cc7bc573abb8b110818a16b_JaffaCakes118
Size

124KB
Sample

240709-lml1dszdja
MD5

2fdaab626cc7bc573abb8b110818a16b
SHA1

24eb2363163747bc003dd79489ed57507efee216
SHA256

c9774645baeb52dc8f3486715fa744b4f57c8704e0d969bd60c6779fba06bde3
SHA512

a3892a0ad57eca508037be61d26de7611d968075ed4308839ee460e0d7e38a3b41b63fc9b07387e594ce0971be61e0d79764458cf8e607bfb8026a90325207db
SSDEEP

3072:NNV2/KcHRoeRssqvuYKmdk/sQBHgIKH/ufXT:Nm/g4ssq2A8BHgFHm7

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  2fdaab626cc7bc573abb8b110818a16b_JaffaCakes118
- Size
  
  124KB
- MD5
  
  2fdaab626cc7bc573abb8b110818a16b
- SHA1
  
  24eb2363163747bc003dd79489ed57507efee216
- SHA256
  
  c9774645baeb52dc8f3486715fa744b4f57c8704e0d969bd60c6779fba06bde3
- SHA512
  
  a3892a0ad57eca508037be61d26de7611d968075ed4308839ee460e0d7e38a3b41b63fc9b07387e594ce0971be61e0d79764458cf8e607bfb8026a90325207db
- SSDEEP
  
  3072:NNV2/KcHRoeRssqvuYKmdk/sQBHgIKH/ufXT:Nm/g4ssq2A8BHgFHm7
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation