c11cc43ea552b0709a82be0fe575fdfe7d5f85a2ebcad79a2e7c0b0e4a4076f4 | Triage

Sharing

General

Target

7522bee22d1a2ca6d1782c0a2e1ef402_JaffaCakes118
Size

216KB
Sample

240726-wnnkqaycrd
MD5

7522bee22d1a2ca6d1782c0a2e1ef402
SHA1

53911c5166bcb3f681cb54c104e1dca0a22bc9c2
SHA256

c11cc43ea552b0709a82be0fe575fdfe7d5f85a2ebcad79a2e7c0b0e4a4076f4
SHA512

6659a47946910c946e0352497d64d80da3497b78b3be2458fc806075e403544875ab9bb22c4347d72e45d200ab16c03b03d2bdf92c0b1cd7b90897aa3e400170
SSDEEP

3072:Lkfz0Yi09gpZb6GNaSw91HttuLWQXIARvBC1:gr0o9iAtRupA

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  7522bee22d1a2ca6d1782c0a2e1ef402_JaffaCakes118
- Size
  
  216KB
- MD5
  
  7522bee22d1a2ca6d1782c0a2e1ef402
- SHA1
  
  53911c5166bcb3f681cb54c104e1dca0a22bc9c2
- SHA256
  
  c11cc43ea552b0709a82be0fe575fdfe7d5f85a2ebcad79a2e7c0b0e4a4076f4
- SHA512
  
  6659a47946910c946e0352497d64d80da3497b78b3be2458fc806075e403544875ab9bb22c4347d72e45d200ab16c03b03d2bdf92c0b1cd7b90897aa3e400170
- SSDEEP
  
  3072:Lkfz0Yi09gpZb6GNaSw91HttuLWQXIARvBC1:gr0o9iAtRupA
Score

7^/10

discovery persistence
- Boot or Logon Autostart Execution: Print Processors
  Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Print Processors

Privilege Escalation

Boot or Logon Autostart Execution

Print Processors

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence