ef7d43ada28a3ce27c5a88bfc93282f83179f4d8fe3732824696eec9a9de1c39 | Triage

Sharing

General

Target

e1cd9b6139c606264db62a2570d7d163_JaffaCakes118
Size

79KB
Sample

240915-ga3edsycjn
MD5

e1cd9b6139c606264db62a2570d7d163
SHA1

3acb5dbb2e03d0b302b58b09a0d3cde77d5bf8ff
SHA256

ef7d43ada28a3ce27c5a88bfc93282f83179f4d8fe3732824696eec9a9de1c39
SHA512

098c9f0a24c1aa93533f9b040aebf8aaf7fe9e1828afe50eb9dccf2afb3b3866c633a8471fcd5543d40ed7777fa47653e46e3199a260760659594d6c11e6af11
SSDEEP

1536:GQuTga8X62MTaUMMnMMMMMQqvuOYQIYQD7eRxA3PtYqcb+sCcNyOa+Mys9H1TDr:FukHFUMMnMMMMMX7I7D7eRa3FYqcbf5U

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  e1cd9b6139c606264db62a2570d7d163_JaffaCakes118
- Size
  
  79KB
- MD5
  
  e1cd9b6139c606264db62a2570d7d163
- SHA1
  
  3acb5dbb2e03d0b302b58b09a0d3cde77d5bf8ff
- SHA256
  
  ef7d43ada28a3ce27c5a88bfc93282f83179f4d8fe3732824696eec9a9de1c39
- SHA512
  
  098c9f0a24c1aa93533f9b040aebf8aaf7fe9e1828afe50eb9dccf2afb3b3866c633a8471fcd5543d40ed7777fa47653e46e3199a260760659594d6c11e6af11
- SSDEEP
  
  1536:GQuTga8X62MTaUMMnMMMMMQqvuOYQIYQD7eRxA3PtYqcb+sCcNyOa+Mys9H1TDr:FukHFUMMnMMMMMX7I7D7eRa3FYqcbf5U
Score

8^/10

discovery evasion persistence privilege_escalation
- Disables Task Manager via registry modification
  evasion
- Event Triggered Execution: AppCert DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

AppCert DLLs

Privilege Escalation

Event Triggered Execution

AppCert DLLs

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation