83300ba5355abdcaa2f3955b475a642d6599193e9b9dc2ee4963895f26e855c9 | Triage

Sharing

General

Target

3e6e53f79e7fb37d02f26b2c21175acd_JaffaCakes118
Size

60KB
Sample

240712-w9dyeavgpp
MD5

3e6e53f79e7fb37d02f26b2c21175acd
SHA1

f0831bd5acd5052863b8bf4f08942936ade086bb
SHA256

83300ba5355abdcaa2f3955b475a642d6599193e9b9dc2ee4963895f26e855c9
SHA512

cd3e64136e2da2e58c8ceeed5e57f888665ed145f2712faf31beefacd70e5fc3c7ffddd3025b11da80707681d8c399ce1cc1defdfe9be8e8c8855e837d91b58f
SSDEEP

768:wBZX+Nzp4mjNx4Ds4l6iE18++uWdB9GBc81f+Iw5BLJUXNPgH9nmscY:wPdc1inuWdB9r8YXPJY2BmscY

Score

8^/10

persistence privilege_escalation

Malware Config

Targets

- Target
  
  3e6e53f79e7fb37d02f26b2c21175acd_JaffaCakes118
- Size
  
  60KB
- MD5
  
  3e6e53f79e7fb37d02f26b2c21175acd
- SHA1
  
  f0831bd5acd5052863b8bf4f08942936ade086bb
- SHA256
  
  83300ba5355abdcaa2f3955b475a642d6599193e9b9dc2ee4963895f26e855c9
- SHA512
  
  cd3e64136e2da2e58c8ceeed5e57f888665ed145f2712faf31beefacd70e5fc3c7ffddd3025b11da80707681d8c399ce1cc1defdfe9be8e8c8855e837d91b58f
- SSDEEP
  
  768:wBZX+Nzp4mjNx4Ds4l6iE18++uWdB9GBc81f+Iw5BLJUXNPgH9nmscY:wPdc1inuWdB9r8YXPJY2BmscY
Score

8^/10

persistence privilege_escalation
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

AppInit DLLs

Privilege Escalation

Event Triggered Execution

AppInit DLLs

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistenceprivilege_escalation

behavioral2

persistenceprivilege_escalation