8443837675f34454c48d23677f89b236a4fe638b6c1703c4172361c48d9ba76e | Triage

Sharing

General

Target

687d47de8151b29668956b7b57eec84a_JaffaCakes118
Size

41KB
Sample

240723-vs7zgs1amp
MD5

687d47de8151b29668956b7b57eec84a
SHA1

a6e691925b3b45f5612353e46a5fcd4b243f0e62
SHA256

8443837675f34454c48d23677f89b236a4fe638b6c1703c4172361c48d9ba76e
SHA512

ec133d802afdd74dbb41e7b41a0a240ad9c416b4ff48ad5d71cf7d8cb8b561837f49d01aa241213a0c2f96c2952021ccc4f5d3a78d72f112ebe13cab3a2a5dc8
SSDEEP

768:ML5HAJa6edPzhvIyLLeCb/sHhpNtzbVMnTEDkjUJvyTK1X2:MFZ6cn/6pD3kQAAX

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Targets

- Target
  
  687d47de8151b29668956b7b57eec84a_JaffaCakes118
- Size
  
  41KB
- MD5
  
  687d47de8151b29668956b7b57eec84a
- SHA1
  
  a6e691925b3b45f5612353e46a5fcd4b243f0e62
- SHA256
  
  8443837675f34454c48d23677f89b236a4fe638b6c1703c4172361c48d9ba76e
- SHA512
  
  ec133d802afdd74dbb41e7b41a0a240ad9c416b4ff48ad5d71cf7d8cb8b561837f49d01aa241213a0c2f96c2952021ccc4f5d3a78d72f112ebe13cab3a2a5dc8
- SSDEEP
  
  768:ML5HAJa6edPzhvIyLLeCb/sHhpNtzbVMnTEDkjUJvyTK1X2:MFZ6cn/6pD3kQAAX
Score

7^/10

discovery persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Checks for any installed AV software in registry
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Component Object Model Hijacking

Privilege Escalation

Event Triggered Execution

Component Object Model Hijacking

Defense Evasion

Credential Access

Discovery

Software Discovery

Security Software Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistenceprivilege_escalation

behavioral2

discoverypersistenceprivilege_escalation