dde6c95bd8ed3e0cb87234611a3fa23b06e48faed84f5c331cfafa1bff007c4d | Triage

Sharing

General

Target

34cdbfd3e2775f97daad1645ef6e26ae_JaffaCakes118
Size

119KB
Sample

240710-p4sq2s1dpc
MD5

34cdbfd3e2775f97daad1645ef6e26ae
SHA1

e17f0da7a2aa2ce121734f627164285dfdc41013
SHA256

dde6c95bd8ed3e0cb87234611a3fa23b06e48faed84f5c331cfafa1bff007c4d
SHA512

ea1bbc5a40bb30b59a10d946b3ffdc63b3d29b1be4053122ceb8860e5e57a974169aa90f917e959fc70285522d494831e5bcfca521d7eb61e4254c658c5913b8
SSDEEP

1536:ZQSRt9VsK79BZ3basVhbFUl9+AqJaCPe+uXVdur4dTD9QN15kvH:Gi/VsKLZrpVhh8FQZuaMdX01o

Score

10^/10

evasion persistence privilege_escalation upx

Malware Config

Targets

- Target
  
  34cdbfd3e2775f97daad1645ef6e26ae_JaffaCakes118
- Size
  
  119KB
- MD5
  
  34cdbfd3e2775f97daad1645ef6e26ae
- SHA1
  
  e17f0da7a2aa2ce121734f627164285dfdc41013
- SHA256
  
  dde6c95bd8ed3e0cb87234611a3fa23b06e48faed84f5c331cfafa1bff007c4d
- SHA512
  
  ea1bbc5a40bb30b59a10d946b3ffdc63b3d29b1be4053122ceb8860e5e57a974169aa90f917e959fc70285522d494831e5bcfca521d7eb61e4254c658c5913b8
- SSDEEP
  
  1536:ZQSRt9VsK79BZ3basVhbFUl9+AqJaCPe+uXVdur4dTD9QN15kvH:Gi/VsKLZrpVhh8FQZuaMdX01o
Score

10^/10

evasion persistence privilege_escalation upx
- Modifies firewall policy service
  evasion
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

AppInit DLLs

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

AppInit DLLs

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalationupx

behavioral2

evasionpersistenceprivilege_escalationupx