a51f33a9961759219420cf4670e6075f388cfcee66db5ac89445a5581c6ef4cd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

38b8ab5100cb66c8e205e7e0267bab27_JaffaCakes118
Size

36KB
Sample

240711-mczzyavcph
MD5

38b8ab5100cb66c8e205e7e0267bab27
SHA1

b15a89879b8803ea56ec8e52fa8add54064f6e79
SHA256

a51f33a9961759219420cf4670e6075f388cfcee66db5ac89445a5581c6ef4cd
SHA512

605e8a55d146e11f3dbede3805f7685e89fdbab88044262060198a48522b9a3cccd23456e36542c758bf38325d35cbe5a23b12c9a849cbd5170864a934f0d360
SSDEEP

768:Nt8dldJN5LXcyXrCD1tDMByGqnXm3+AVWEvaLW:OdzcyXrC/GsnXiVWEvaLW

Score

8^/10

persistence privilege_escalation

Malware Config

Targets

- Target
  
  38b8ab5100cb66c8e205e7e0267bab27_JaffaCakes118
- Size
  
  36KB
- MD5
  
  38b8ab5100cb66c8e205e7e0267bab27
- SHA1
  
  b15a89879b8803ea56ec8e52fa8add54064f6e79
- SHA256
  
  a51f33a9961759219420cf4670e6075f388cfcee66db5ac89445a5581c6ef4cd
- SHA512
  
  605e8a55d146e11f3dbede3805f7685e89fdbab88044262060198a48522b9a3cccd23456e36542c758bf38325d35cbe5a23b12c9a849cbd5170864a934f0d360
- SSDEEP
  
  768:Nt8dldJN5LXcyXrCD1tDMByGqnXm3+AVWEvaLW:OdzcyXrC/GsnXiVWEvaLW
Score

8^/10

persistence privilege_escalation
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

AppInit DLLs

Privilege Escalation

Event Triggered Execution

AppInit DLLs

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistenceprivilege_escalation

behavioral2

persistenceprivilege_escalation