16449ddb6b1d88368da42175a126041d24b90d1498760e8e12dd340ed30f5666 | Triage

Sharing

General

Target

8c9ee2556eb31f2b7608c54b335f5e39_JaffaCakes118
Size

139KB
Sample

240812-axr4ls1eke
MD5

8c9ee2556eb31f2b7608c54b335f5e39
SHA1

82f3f250019e361bf90f7b2d649ecd55634460e1
SHA256

16449ddb6b1d88368da42175a126041d24b90d1498760e8e12dd340ed30f5666
SHA512

2279b0fe536f287f895385628c58d3668417b3d51a62f32fc50187e92377b7cfae79587195175c79bab87538c522fbf2819683b76995d71e2f7b06e75de9d67a
SSDEEP

3072:JMTdQO2oWRrMu4Ubc6mFG/SyTOSd0+uZRpQNnJSKa4PO8T:J41SVwDcdTddbMLQNnza+T

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  8c9ee2556eb31f2b7608c54b335f5e39_JaffaCakes118
- Size
  
  139KB
- MD5
  
  8c9ee2556eb31f2b7608c54b335f5e39
- SHA1
  
  82f3f250019e361bf90f7b2d649ecd55634460e1
- SHA256
  
  16449ddb6b1d88368da42175a126041d24b90d1498760e8e12dd340ed30f5666
- SHA512
  
  2279b0fe536f287f895385628c58d3668417b3d51a62f32fc50187e92377b7cfae79587195175c79bab87538c522fbf2819683b76995d71e2f7b06e75de9d67a
- SSDEEP
  
  3072:JMTdQO2oWRrMu4Ubc6mFG/SyTOSd0+uZRpQNnJSKa4PO8T:J41SVwDcdTddbMLQNnza+T
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2