6cc33cfbef169eb7238bd2ac50e00157627af2ecdece5197e2b07629dc30fe38 | Triage

Sharing

General

Target

41f983eaca828b412a2c5faeba891a2f_JaffaCakes118
Size

138KB
Sample

240713-ray23swaka
MD5

41f983eaca828b412a2c5faeba891a2f
SHA1

434ef3317a5d2f657dcf07853a649e5bb3eab9a8
SHA256

6cc33cfbef169eb7238bd2ac50e00157627af2ecdece5197e2b07629dc30fe38
SHA512

3ad38158240aa3fc29382d462d9cf319deda2941fff0bea7808d456db31640b6f55a9daeb14b402ac333f664749a206119e5858ccfc91c5a455723e7938b057c
SSDEEP

3072:F1+YjqUZ+R5ER1xxpo1LvEt+ouumo/xrJml:F0UYEqLvM19Q

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  41f983eaca828b412a2c5faeba891a2f_JaffaCakes118
- Size
  
  138KB
- MD5
  
  41f983eaca828b412a2c5faeba891a2f
- SHA1
  
  434ef3317a5d2f657dcf07853a649e5bb3eab9a8
- SHA256
  
  6cc33cfbef169eb7238bd2ac50e00157627af2ecdece5197e2b07629dc30fe38
- SHA512
  
  3ad38158240aa3fc29382d462d9cf319deda2941fff0bea7808d456db31640b6f55a9daeb14b402ac333f664749a206119e5858ccfc91c5a455723e7938b057c
- SSDEEP
  
  3072:F1+YjqUZ+R5ER1xxpo1LvEt+ouumo/xrJml:F0UYEqLvM19Q
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2