506342243db5998de802937dd8a1a0ce63bd4822703150a36469c8f22f55060c | Triage

Sharing

General

Target

ebb6eedcb868b4940409ec48e73688b3_JaffaCakes118
Size

111KB
Sample

240919-tree4sybpr
MD5

ebb6eedcb868b4940409ec48e73688b3
SHA1

9e5b7f1c4ba3eba88dd307e46af1d084cf5f8b03
SHA256

506342243db5998de802937dd8a1a0ce63bd4822703150a36469c8f22f55060c
SHA512

250773f7fc4745130de22e80b5c00102df81e7eb810d76c928af74dafcef315de7669f33095f5c36c8257ad43bffdc9f331ce105b229a4f7bfb2fbd963811f08
SSDEEP

3072:BmLm2L1szSZx3Y9+Up1LVGOEWLZbfMiqFflMs4h:BmvLGG3YwUpkWNXqtl6h

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  ebb6eedcb868b4940409ec48e73688b3_JaffaCakes118
- Size
  
  111KB
- MD5
  
  ebb6eedcb868b4940409ec48e73688b3
- SHA1
  
  9e5b7f1c4ba3eba88dd307e46af1d084cf5f8b03
- SHA256
  
  506342243db5998de802937dd8a1a0ce63bd4822703150a36469c8f22f55060c
- SHA512
  
  250773f7fc4745130de22e80b5c00102df81e7eb810d76c928af74dafcef315de7669f33095f5c36c8257ad43bffdc9f331ce105b229a4f7bfb2fbd963811f08
- SSDEEP
  
  3072:BmLm2L1szSZx3Y9+Up1LVGOEWLZbfMiqFflMs4h:BmvLGG3YwUpkWNXqtl6h
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation