ab836f910c75da6ee93dbab2da609ed01edc60f6367341a0c5d57a089d19105d | Triage

Sharing

General

Target

7847df179d76ab43508988cd7858a46a_JaffaCakes118
Size

147KB
Sample

240727-qa6w9ateqc
MD5

7847df179d76ab43508988cd7858a46a
SHA1

813a5f4f5643c05472eb4515ec4f74d35265dfc4
SHA256

ab836f910c75da6ee93dbab2da609ed01edc60f6367341a0c5d57a089d19105d
SHA512

e56579fe18a9795cf5978b0b3c713324417f542c649a76ff3f061b249d3be1a86f707e8fcf91e45f10e6b73ad560bf498a9b432e09e64bb015eb5ed8a1017b68
SSDEEP

3072:zX38PXq6bA0pX4TuMs9gml5ik4Iaol7Ecy6ktlKREqmP0UAA:zX3yqqATuM1ml5gIaol7f+3AUA

Score

10^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  7847df179d76ab43508988cd7858a46a_JaffaCakes118
- Size
  
  147KB
- MD5
  
  7847df179d76ab43508988cd7858a46a
- SHA1
  
  813a5f4f5643c05472eb4515ec4f74d35265dfc4
- SHA256
  
  ab836f910c75da6ee93dbab2da609ed01edc60f6367341a0c5d57a089d19105d
- SHA512
  
  e56579fe18a9795cf5978b0b3c713324417f542c649a76ff3f061b249d3be1a86f707e8fcf91e45f10e6b73ad560bf498a9b432e09e64bb015eb5ed8a1017b68
- SSDEEP
  
  3072:zX38PXq6bA0pX4TuMs9gml5ik4Iaol7Ecy6ktlKREqmP0UAA:zX3yqqATuM1ml5gIaol7f+3AUA
Score

10^/10

discovery evasion persistence privilege_escalation
- Modifies firewall policy service
  evasion
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation