8e6e70cfd53cb4c611302cc01b910f642c6334e63f605aa319c003cb44d5af5e | Triage

Sharing

General

Target

40c9ec09300645004af4ce1b5594901e_JaffaCakes118
Size

36KB
Sample

240713-jkcb3avara
MD5

40c9ec09300645004af4ce1b5594901e
SHA1

e48edd5ce62db95592c6dd92cbee66eebabd0c22
SHA256

8e6e70cfd53cb4c611302cc01b910f642c6334e63f605aa319c003cb44d5af5e
SHA512

290b09d0bdd7a6cefd7eae97be818f91fdc2eaf5da80a0cccae906b9d10b8ba49b0c9fd7f30ae544008e69c344e942af14197f6481ed7ab742f81e541a36c7cf
SSDEEP

768:jt8dldJN5LXcyXrCD1tDMByGqnXm3+AVWEvaLW:EdzcyXrC/GsnXiVWEvaLW

Score

8^/10

persistence privilege_escalation

Malware Config

Targets

- Target
  
  40c9ec09300645004af4ce1b5594901e_JaffaCakes118
- Size
  
  36KB
- MD5
  
  40c9ec09300645004af4ce1b5594901e
- SHA1
  
  e48edd5ce62db95592c6dd92cbee66eebabd0c22
- SHA256
  
  8e6e70cfd53cb4c611302cc01b910f642c6334e63f605aa319c003cb44d5af5e
- SHA512
  
  290b09d0bdd7a6cefd7eae97be818f91fdc2eaf5da80a0cccae906b9d10b8ba49b0c9fd7f30ae544008e69c344e942af14197f6481ed7ab742f81e541a36c7cf
- SSDEEP
  
  768:jt8dldJN5LXcyXrCD1tDMByGqnXm3+AVWEvaLW:EdzcyXrC/GsnXiVWEvaLW
Score

8^/10

persistence privilege_escalation
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

AppInit DLLs

Privilege Escalation

Event Triggered Execution

AppInit DLLs

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistenceprivilege_escalation

behavioral2

persistenceprivilege_escalation