c2890347e052b6dcb2a35e9be996d6e20b86085f3c4885d22c83b26fec1ef323 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7387dd0f00f1c88a6ecae0bc5c32081c_JaffaCakes118
Size

121KB
Sample

240726-lq9kvszdnp
MD5

7387dd0f00f1c88a6ecae0bc5c32081c
SHA1

cf80b697ea5280b9c42a5b3b05972acab2587219
SHA256

c2890347e052b6dcb2a35e9be996d6e20b86085f3c4885d22c83b26fec1ef323
SHA512

b50fe51a04e8d42852b4c2e1cfcd6fd4f3f9ddd714eb70f4ec07ab2e00a19bada33a0ceda58f7af348ada3ff352f715872175764d5d62b2732efa54c3d027d0c
SSDEEP

3072:sth7GwfwoGOfALNLEAq8Ih96Bt8capKf6:sthNfd9fWNLEAVUABRZ

Score

10^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  7387dd0f00f1c88a6ecae0bc5c32081c_JaffaCakes118
- Size
  
  121KB
- MD5
  
  7387dd0f00f1c88a6ecae0bc5c32081c
- SHA1
  
  cf80b697ea5280b9c42a5b3b05972acab2587219
- SHA256
  
  c2890347e052b6dcb2a35e9be996d6e20b86085f3c4885d22c83b26fec1ef323
- SHA512
  
  b50fe51a04e8d42852b4c2e1cfcd6fd4f3f9ddd714eb70f4ec07ab2e00a19bada33a0ceda58f7af348ada3ff352f715872175764d5d62b2732efa54c3d027d0c
- SSDEEP
  
  3072:sth7GwfwoGOfALNLEAq8Ih96Bt8capKf6:sthNfd9fWNLEAVUABRZ
Score

10^/10

discovery evasion persistence privilege_escalation
- Modifies firewall policy service
  evasion
- Drops file in Drivers directory
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoveryevasionpersistenceprivilege_escalation