7d9905f86d6deb20e9c2860397a0c6a2e70c23c40e215fa2f765170a1fbdcfd1 | Triage

Sharing

General

Target

3ec889f581e10fdca1dd4907b1743b5c_JaffaCakes118
Size

4.4MB
Sample

240712-zbwx4s1fmb
MD5

3ec889f581e10fdca1dd4907b1743b5c
SHA1

6769be6939b4794448943863bf0eea5ffb6acdf4
SHA256

7d9905f86d6deb20e9c2860397a0c6a2e70c23c40e215fa2f765170a1fbdcfd1
SHA512

840d1d88fe8812f5eae068774da3c77913b2801a35870f53d661338c6cf766fdc877c50174d02542200e340b43485f6c62c9fed970b5495745ce504107967e32
SSDEEP

6144:aZm8z/o87OlzE5TKHpd3yffWRBOz77ZR3T1:vHpd3IWRBOz77b3T

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  3ec889f581e10fdca1dd4907b1743b5c_JaffaCakes118
- Size
  
  4.4MB
- MD5
  
  3ec889f581e10fdca1dd4907b1743b5c
- SHA1
  
  6769be6939b4794448943863bf0eea5ffb6acdf4
- SHA256
  
  7d9905f86d6deb20e9c2860397a0c6a2e70c23c40e215fa2f765170a1fbdcfd1
- SHA512
  
  840d1d88fe8812f5eae068774da3c77913b2801a35870f53d661338c6cf766fdc877c50174d02542200e340b43485f6c62c9fed970b5495745ce504107967e32
- SSDEEP
  
  6144:aZm8z/o87OlzE5TKHpd3yffWRBOz77ZR3T1:vHpd3IWRBOz77b3T
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation