cc1ff92c5cd78cd2970fd1de837e5c29e8067e288cbba0f2b095b908e2c83b7a | Triage

Sharing

General

Target

7071cdee02fbe8c703c6ef8e9325eab8_JaffaCakes118
Size

122KB
Sample

240725-vfcb2swbrf
MD5

7071cdee02fbe8c703c6ef8e9325eab8
SHA1

22289c199cf6245c190720c34b143749ddf6fb6e
SHA256

cc1ff92c5cd78cd2970fd1de837e5c29e8067e288cbba0f2b095b908e2c83b7a
SHA512

c1c84471254a5c51ee74d1d0c8cc4081b4d40debe6ff6c9e4bdc0f41312faa3781c3d3e9c2de1b7f7b7e76adbdb798c0cbe98cf1efa50fe504382834bff98f92
SSDEEP

1536:z2uv+XLWWMRFRAP89VUqpO8rUQYWqow+/z2uB6lrjHGtLiLMdxtFZcx:UqzFRAwBo8rbqxGzPB6xjmtL6OY

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  7071cdee02fbe8c703c6ef8e9325eab8_JaffaCakes118
- Size
  
  122KB
- MD5
  
  7071cdee02fbe8c703c6ef8e9325eab8
- SHA1
  
  22289c199cf6245c190720c34b143749ddf6fb6e
- SHA256
  
  cc1ff92c5cd78cd2970fd1de837e5c29e8067e288cbba0f2b095b908e2c83b7a
- SHA512
  
  c1c84471254a5c51ee74d1d0c8cc4081b4d40debe6ff6c9e4bdc0f41312faa3781c3d3e9c2de1b7f7b7e76adbdb798c0cbe98cf1efa50fe504382834bff98f92
- SSDEEP
  
  1536:z2uv+XLWWMRFRAP89VUqpO8rUQYWqow+/z2uB6lrjHGtLiLMdxtFZcx:UqzFRAwBo8rbqxGzPB6xjmtL6OY
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2