997bee7508a2beeec3d7aaa6d16d7228cceb47cf0e5ab19901500b98510012bf | Triage

Sharing

General

Target

b86de8b3f46a2705c802e506f09e747c_JaffaCakes118
Size

124KB
Sample

240822-vm41mszhrq
MD5

b86de8b3f46a2705c802e506f09e747c
SHA1

86de20b5ae307d23cb4b62d9c04b9c9108366bab
SHA256

997bee7508a2beeec3d7aaa6d16d7228cceb47cf0e5ab19901500b98510012bf
SHA512

90526ebb4b4e4a14b7059967a5249e7c84fa60652dbb64b9a73f33d6eff5bc45a59c576948d2001e17fa5975c9de96a39d0fe3bf1ff512e29b6595176db97912
SSDEEP

3072:cbdYxNRD40hHgzW1FMUMff6QNznK2Pg+QFg7S:IdV0XbMf/NznK2IH

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  b86de8b3f46a2705c802e506f09e747c_JaffaCakes118
- Size
  
  124KB
- MD5
  
  b86de8b3f46a2705c802e506f09e747c
- SHA1
  
  86de20b5ae307d23cb4b62d9c04b9c9108366bab
- SHA256
  
  997bee7508a2beeec3d7aaa6d16d7228cceb47cf0e5ab19901500b98510012bf
- SHA512
  
  90526ebb4b4e4a14b7059967a5249e7c84fa60652dbb64b9a73f33d6eff5bc45a59c576948d2001e17fa5975c9de96a39d0fe3bf1ff512e29b6595176db97912
- SSDEEP
  
  3072:cbdYxNRD40hHgzW1FMUMff6QNznK2Pg+QFg7S:IdV0XbMf/NznK2IH
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation