785b00696c27b02b78947f8d87e25882e7d09c82415e5d5e85a7240b4c95bfe1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ebdd7b7071ff7b986e435a04a24e52b5_JaffaCakes118
Size

227KB
Sample

240919-wacw3a1end
MD5

ebdd7b7071ff7b986e435a04a24e52b5
SHA1

26f103331c03722cedd82fc6eda52b269ff4db98
SHA256

785b00696c27b02b78947f8d87e25882e7d09c82415e5d5e85a7240b4c95bfe1
SHA512

ff78017896bb7040aa57fe35a7c64a4cd8b34897335e41c94f254ae65b4a53d149129da4edde8a4163ea9f9609a5775ceb15eacd937fe30014044a44fa5e4e5b
SSDEEP

3072:h6NDlMLzm/FdDgIkLfrCEXfBhBkiUFht/e3vp6c8K90s+c+WJbiZ90ufzy12vbGs:h6kvocI4x3UFhw/D0su0mX5fuCDF

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  ebdd7b7071ff7b986e435a04a24e52b5_JaffaCakes118
- Size
  
  227KB
- MD5
  
  ebdd7b7071ff7b986e435a04a24e52b5
- SHA1
  
  26f103331c03722cedd82fc6eda52b269ff4db98
- SHA256
  
  785b00696c27b02b78947f8d87e25882e7d09c82415e5d5e85a7240b4c95bfe1
- SHA512
  
  ff78017896bb7040aa57fe35a7c64a4cd8b34897335e41c94f254ae65b4a53d149129da4edde8a4163ea9f9609a5775ceb15eacd937fe30014044a44fa5e4e5b
- SSDEEP
  
  3072:h6NDlMLzm/FdDgIkLfrCEXfBhBkiUFht/e3vp6c8K90s+c+WJbiZ90ufzy12vbGs:h6kvocI4x3UFhw/D0su0mX5fuCDF
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2