921346ec376c30543c1bac95921cbc478ecb10d7860cf42d71e5c989725722e5 | Triage

Sharing

General

Target

49bc64d1504f4928f03de3ac73eb1d84_JaffaCakes118
Size

18KB
Sample

240715-peqv6azanq
MD5

49bc64d1504f4928f03de3ac73eb1d84
SHA1

2470dbe54d86559607e152361b18a0eb4f8914ce
SHA256

921346ec376c30543c1bac95921cbc478ecb10d7860cf42d71e5c989725722e5
SHA512

e541c4ef9ea8e3787ff623ae353b9aa6c289571406cc887eafccb083d65062670db64b517fd8996b8a11db831ffd26b36f927ac3cba7fe0d47fc509c5917bd00
SSDEEP

384:nBTI0lRLVfvRQGhd29Go8oKB2nE8bWVxtd4Yf0FpwN1pof7CVzPIx:60jLVfvRj28FB2nKXT4Y8FpwxoTCpPIx

Score

8^/10

persistence privilege_escalation

Malware Config

Targets

- Target
  
  49bc64d1504f4928f03de3ac73eb1d84_JaffaCakes118
- Size
  
  18KB
- MD5
  
  49bc64d1504f4928f03de3ac73eb1d84
- SHA1
  
  2470dbe54d86559607e152361b18a0eb4f8914ce
- SHA256
  
  921346ec376c30543c1bac95921cbc478ecb10d7860cf42d71e5c989725722e5
- SHA512
  
  e541c4ef9ea8e3787ff623ae353b9aa6c289571406cc887eafccb083d65062670db64b517fd8996b8a11db831ffd26b36f927ac3cba7fe0d47fc509c5917bd00
- SSDEEP
  
  384:nBTI0lRLVfvRQGhd29Go8oKB2nE8bWVxtd4Yf0FpwN1pof7CVzPIx:60jLVfvRj28FB2nKXT4Y8FpwxoTCpPIx
Score

8^/10

persistence privilege_escalation
- Drops file in Drivers directory
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Deletes itself
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

AppInit DLLs

Privilege Escalation

Event Triggered Execution

AppInit DLLs

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistenceprivilege_escalation

behavioral2