fe445373b3165ec2b6728ce8e95c72f77f80b786084e9bce2c00567e2967ded1 | Triage

Sharing

General

Target

c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118
Size

86KB
Sample

240828-3c7msatekj
MD5

c7d591d67eaef372ed375a0aaf2a0c76
SHA1

d696553d1d8f1f800765958a2e9dec682d21a76c
SHA256

fe445373b3165ec2b6728ce8e95c72f77f80b786084e9bce2c00567e2967ded1
SHA512

060a03999123e3dccdd63476b750235be9a7d02cf690c041eed51789af45ecddac756b92b407530854e73d803baef26ecabf5adb45c19242da021853ad239a48
SSDEEP

1536:khJAP49cOw7Wi7TjGzyu/V5OCD/QL5P060axISYzC6wuEa:khOP4ecOjGzym1p60axTYzm6

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Targets

- Target
  
  c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118
- Size
  
  86KB
- MD5
  
  c7d591d67eaef372ed375a0aaf2a0c76
- SHA1
  
  d696553d1d8f1f800765958a2e9dec682d21a76c
- SHA256
  
  fe445373b3165ec2b6728ce8e95c72f77f80b786084e9bce2c00567e2967ded1
- SHA512
  
  060a03999123e3dccdd63476b750235be9a7d02cf690c041eed51789af45ecddac756b92b407530854e73d803baef26ecabf5adb45c19242da021853ad239a48
- SSDEEP
  
  1536:khJAP49cOw7Wi7TjGzyu/V5OCD/QL5P060axISYzC6wuEa:khOP4ecOjGzym1p60axTYzm6
Score

7^/10

persistence privilege_escalation discovery
- Loads dropped DLL
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Authentication Package

Privilege Escalation

Boot or Logon Autostart Execution

Authentication Package

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistenceprivilege_escalation

behavioral2

discoverypersistenceprivilege_escalation