27c1c9bc041c70ee9aa9ff2014c8e9caa5c0e2b9fad73a7eae4d8320a2d616ee | Triage

Sharing

General

Target

eabba4f646e2df0cb6bab2ad256f0765_JaffaCakes118
Size

76KB
Sample

240919-gwsgbavclr
MD5

eabba4f646e2df0cb6bab2ad256f0765
SHA1

b2159cb385113c1c2488825aca2441a4fd8c7b7d
SHA256

27c1c9bc041c70ee9aa9ff2014c8e9caa5c0e2b9fad73a7eae4d8320a2d616ee
SHA512

74ae2e0bac330a3a08757de4cf9fdfc4fe3fd9171aab19b6ec376acaea610ab188c9784a839f52a7fb9c2445c80bc86e0c57a5419837523479c9be5a6dac45b9
SSDEEP

1536:OWoV5lEWxcIOA2XfJgeNzP9Z1iHhCtt9w11TdYkAF4fqYuuTGlMdopJlI0:/8lEWRaviyzgBC3KFdYPtuTGIopJlI0

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Targets

- Target
  
  eabba4f646e2df0cb6bab2ad256f0765_JaffaCakes118
- Size
  
  76KB
- MD5
  
  eabba4f646e2df0cb6bab2ad256f0765
- SHA1
  
  b2159cb385113c1c2488825aca2441a4fd8c7b7d
- SHA256
  
  27c1c9bc041c70ee9aa9ff2014c8e9caa5c0e2b9fad73a7eae4d8320a2d616ee
- SHA512
  
  74ae2e0bac330a3a08757de4cf9fdfc4fe3fd9171aab19b6ec376acaea610ab188c9784a839f52a7fb9c2445c80bc86e0c57a5419837523479c9be5a6dac45b9
- SSDEEP
  
  1536:OWoV5lEWxcIOA2XfJgeNzP9Z1iHhCtt9w11TdYkAF4fqYuuTGlMdopJlI0:/8lEWRaviyzgBC3KFdYPtuTGIopJlI0
Score

8^/10

discovery persistence privilege_escalation
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

AppInit DLLs

Privilege Escalation

Event Triggered Execution

AppInit DLLs

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistenceprivilege_escalation

behavioral2

discoverypersistenceprivilege_escalation