689669a16d8867e85a38979ff0b3cdb058cc5a97a1b8ad62fcfadf0640a429ae | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d5ef171b81407406673ffc25fb88ed05_JaffaCakes118
Size

115KB
Sample

240909-j5c44ayepn
MD5

d5ef171b81407406673ffc25fb88ed05
SHA1

b56138729fe47f9b60caf37064d96138b8631a37
SHA256

689669a16d8867e85a38979ff0b3cdb058cc5a97a1b8ad62fcfadf0640a429ae
SHA512

74d4ec169d26206702d8e1282774d03da0a805e0757a3a58abeb0f1634af662ee7c3653465243eb55e48eedae37a37bcbee685b6f4c3a9462032e0f2ddbc398e
SSDEEP

3072:SGaK4XabO7xlI8r9iJw7AzAAn/6asu1TUybroaUKZt:MpCzAiAu14yfoFKZ

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  d5ef171b81407406673ffc25fb88ed05_JaffaCakes118
- Size
  
  115KB
- MD5
  
  d5ef171b81407406673ffc25fb88ed05
- SHA1
  
  b56138729fe47f9b60caf37064d96138b8631a37
- SHA256
  
  689669a16d8867e85a38979ff0b3cdb058cc5a97a1b8ad62fcfadf0640a429ae
- SHA512
  
  74d4ec169d26206702d8e1282774d03da0a805e0757a3a58abeb0f1634af662ee7c3653465243eb55e48eedae37a37bcbee685b6f4c3a9462032e0f2ddbc398e
- SSDEEP
  
  3072:SGaK4XabO7xlI8r9iJw7AzAAn/6asu1TUybroaUKZt:MpCzAiAu14yfoFKZ
Score

7^/10

discovery persistence
- Boot or Logon Autostart Execution: Print Processors
  Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
  persistence
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Print Processors

Privilege Escalation

Boot or Logon Autostart Execution

Print Processors

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence