247bf157e683c370aa9d355da0fca95c2f2934110390bd69b7531f16d60eeb62 | Triage

Sharing

General

Target

3d370e723292863b66df4dc9c078c54a_JaffaCakes118
Size

116KB
Sample

240712-nqndqstfnc
MD5

3d370e723292863b66df4dc9c078c54a
SHA1

c449db767ef3aec41e1dd9ade4d7848585d34b0b
SHA256

247bf157e683c370aa9d355da0fca95c2f2934110390bd69b7531f16d60eeb62
SHA512

f7b3a854fd655ec82516ce6a12e06f4a4f38b5fe57643abab6cd751764b48d88c661a5965fb8dc4783c74acca5db2a080fedc73d75a19d75c30e167c07949321
SSDEEP

1536:Ww2lTPGB6ZlSs8lXcwsfeGF2Upi+Y8NjgYqor7p0dFfulVJQicacrHtKWUi5ek4G:sTP8lXHNVUgVhcFDcrHoWUike

Score

10^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  3d370e723292863b66df4dc9c078c54a_JaffaCakes118
- Size
  
  116KB
- MD5
  
  3d370e723292863b66df4dc9c078c54a
- SHA1
  
  c449db767ef3aec41e1dd9ade4d7848585d34b0b
- SHA256
  
  247bf157e683c370aa9d355da0fca95c2f2934110390bd69b7531f16d60eeb62
- SHA512
  
  f7b3a854fd655ec82516ce6a12e06f4a4f38b5fe57643abab6cd751764b48d88c661a5965fb8dc4783c74acca5db2a080fedc73d75a19d75c30e167c07949321
- SSDEEP
  
  1536:Ww2lTPGB6ZlSs8lXcwsfeGF2Upi+Y8NjgYqor7p0dFfulVJQicacrHtKWUi5ek4G:sTP8lXHNVUgVhcFDcrHoWUike
Score

10^/10

evasion persistence privilege_escalation
- Modifies firewall policy service
  evasion
- Blocklisted process makes network request
- Modifies Windows Firewall
  evasion
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation