67686b45918053faf68fd7480d40c8e657b77f6aaf45e07b4c902f8e0bf27494 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5dfea8c354bf16e035cf43fc7b753622_JaffaCakes118
Size

286KB
Sample

240719-2pk4waxdqg
MD5

5dfea8c354bf16e035cf43fc7b753622
SHA1

fbdad5c06405f2e3dc1f9bdcaa8cd42c7711e4f3
SHA256

67686b45918053faf68fd7480d40c8e657b77f6aaf45e07b4c902f8e0bf27494
SHA512

0f0141ad1105c8c53c43a47070237a931eacacaf84ef0e5d7975480cc46d1d110c7ac8d6f82d71063a3a9b216b2bd4b29916da03949e1a24af4d308949fd6286
SSDEEP

6144:Ivoq2CIKh5J4STNUSg37Z1CLJLYPtIk44zw+K1cDHAKi8yK:Ivo69hcSKN7Z14J+bFK10H5iZK

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  5dfea8c354bf16e035cf43fc7b753622_JaffaCakes118
- Size
  
  286KB
- MD5
  
  5dfea8c354bf16e035cf43fc7b753622
- SHA1
  
  fbdad5c06405f2e3dc1f9bdcaa8cd42c7711e4f3
- SHA256
  
  67686b45918053faf68fd7480d40c8e657b77f6aaf45e07b4c902f8e0bf27494
- SHA512
  
  0f0141ad1105c8c53c43a47070237a931eacacaf84ef0e5d7975480cc46d1d110c7ac8d6f82d71063a3a9b216b2bd4b29916da03949e1a24af4d308949fd6286
- SSDEEP
  
  6144:Ivoq2CIKh5J4STNUSg37Z1CLJLYPtIk44zw+K1cDHAKi8yK:Ivo69hcSKN7Z14J+bFK10H5iZK
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation