c92a69107302dc1d19604fe14a5d7dc1e5d55df11876e56f3bbe63a251b4166b | Triage

Sharing

General

Target

ce0f5126685018dc34bf74ccb414baf9_JaffaCakes118
Size

139KB
Sample

240905-199sas1gpl
MD5

ce0f5126685018dc34bf74ccb414baf9
SHA1

97d51925a8900014def31b397efb7dbc05a9dd36
SHA256

c92a69107302dc1d19604fe14a5d7dc1e5d55df11876e56f3bbe63a251b4166b
SHA512

43fc8b332517846cfb7a10f42ccb3b40fb0eb98c407098ea1ea1911337fb430e15db8cad5c53c57c18bb96e4898caf28d003c9d3b142c299782ba8fa84cb6555
SSDEEP

3072:w6wyam7CzR54cNlixcZjrSYeRmtlSh7Af/aiI0:Vv7W4cNhNaulS0SiI0

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  ce0f5126685018dc34bf74ccb414baf9_JaffaCakes118
- Size
  
  139KB
- MD5
  
  ce0f5126685018dc34bf74ccb414baf9
- SHA1
  
  97d51925a8900014def31b397efb7dbc05a9dd36
- SHA256
  
  c92a69107302dc1d19604fe14a5d7dc1e5d55df11876e56f3bbe63a251b4166b
- SHA512
  
  43fc8b332517846cfb7a10f42ccb3b40fb0eb98c407098ea1ea1911337fb430e15db8cad5c53c57c18bb96e4898caf28d003c9d3b142c299782ba8fa84cb6555
- SSDEEP
  
  3072:w6wyam7CzR54cNlixcZjrSYeRmtlSh7Af/aiI0:Vv7W4cNhNaulS0SiI0
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation