5dc75d840fc4826c9b6182bf899c530b1fe7a19e1511dc7c6e0c27cc5846184d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

31a6022c75e0ed2a16582aa53d38d4af_JaffaCakes118
Size

116KB
Sample

240709-x1q22s1aqk
MD5

31a6022c75e0ed2a16582aa53d38d4af
SHA1

c1303e52aa65dcaba3a396d0cfff697e877abd22
SHA256

5dc75d840fc4826c9b6182bf899c530b1fe7a19e1511dc7c6e0c27cc5846184d
SHA512

8252f3a0ce51f4d31c86264e463734f27cb66553733b1bfcfe8c888ccd264329255e7879f15a9cdffd5980a9676f28290d7bf90a1f4ae2bccc75725bbff623b1
SSDEEP

3072:+QGzeYirlRny1hCygPjSZgttQxbyw4QA:tYVcwIvPttt3F

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  31a6022c75e0ed2a16582aa53d38d4af_JaffaCakes118
- Size
  
  116KB
- MD5
  
  31a6022c75e0ed2a16582aa53d38d4af
- SHA1
  
  c1303e52aa65dcaba3a396d0cfff697e877abd22
- SHA256
  
  5dc75d840fc4826c9b6182bf899c530b1fe7a19e1511dc7c6e0c27cc5846184d
- SHA512
  
  8252f3a0ce51f4d31c86264e463734f27cb66553733b1bfcfe8c888ccd264329255e7879f15a9cdffd5980a9676f28290d7bf90a1f4ae2bccc75725bbff623b1
- SSDEEP
  
  3072:+QGzeYirlRny1hCygPjSZgttQxbyw4QA:tYVcwIvPttt3F
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation