4dd3e653cfe8a8441aff6a1cf6a4441185217c390da372f9b4c7c02aca1976da | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a49e6d3677c962df4922164a098e7d4f_JaffaCakes118
Size

104KB
Sample

240818-acr8wathrd
MD5

a49e6d3677c962df4922164a098e7d4f
SHA1

5bbfb4148661b3f61588558e64c74fd40aee5e11
SHA256

4dd3e653cfe8a8441aff6a1cf6a4441185217c390da372f9b4c7c02aca1976da
SHA512

c319f980fa1a09d3e533c18ce0c5c52330218a9c1136b04b4944aa34eed122001b1622dd7314f5379966bbe2f05dc52a6209829d035caf72fd1d65787e5f0063
SSDEEP

3072:xQ4uPaPfPfT2IIH/cNfX2KI4SebBgyoD0:mTwnL2HH/+vVI6qG

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Targets

- Target
  
  a49e6d3677c962df4922164a098e7d4f_JaffaCakes118
- Size
  
  104KB
- MD5
  
  a49e6d3677c962df4922164a098e7d4f
- SHA1
  
  5bbfb4148661b3f61588558e64c74fd40aee5e11
- SHA256
  
  4dd3e653cfe8a8441aff6a1cf6a4441185217c390da372f9b4c7c02aca1976da
- SHA512
  
  c319f980fa1a09d3e533c18ce0c5c52330218a9c1136b04b4944aa34eed122001b1622dd7314f5379966bbe2f05dc52a6209829d035caf72fd1d65787e5f0063
- SSDEEP
  
  3072:xQ4uPaPfPfT2IIH/cNfX2KI4SebBgyoD0:mTwnL2HH/+vVI6qG
Score

8^/10

discovery persistence privilege_escalation
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

AppInit DLLs

Privilege Escalation

Event Triggered Execution

AppInit DLLs

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistenceprivilege_escalation

behavioral2

discoverypersistenceprivilege_escalation