13d55f5939efb8c33b919be41cc9b8ef59ea6723696b7e9f8e1fc09018348b10 | Triage

Sharing

General

Target

f0cfb7803fdb015936c4ef6a3c038aa4_JaffaCakes118
Size

36KB
Sample

240921-3af22szcrc
MD5

f0cfb7803fdb015936c4ef6a3c038aa4
SHA1

abc4789318612e50dc0462d1b2cd801483528982
SHA256

13d55f5939efb8c33b919be41cc9b8ef59ea6723696b7e9f8e1fc09018348b10
SHA512

b3a457ccabc02c9be3bac65fdee22e72b632e076d24152041c0f7bdeff9b48e4b5b250f0cecff0f381d0bd62b056950f9b88fbc5c79d0ee6fc54ef0b20736344
SSDEEP

384:SOgGIbRJpai9c49Wigp5/y+ixe1+B6BDR+v+I7J3SvwKF58o2iU+:GjgiGxy+is1M6BDRK97J3+ZFWo2iU+

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Targets

- Target
  
  f0cfb7803fdb015936c4ef6a3c038aa4_JaffaCakes118
- Size
  
  36KB
- MD5
  
  f0cfb7803fdb015936c4ef6a3c038aa4
- SHA1
  
  abc4789318612e50dc0462d1b2cd801483528982
- SHA256
  
  13d55f5939efb8c33b919be41cc9b8ef59ea6723696b7e9f8e1fc09018348b10
- SHA512
  
  b3a457ccabc02c9be3bac65fdee22e72b632e076d24152041c0f7bdeff9b48e4b5b250f0cecff0f381d0bd62b056950f9b88fbc5c79d0ee6fc54ef0b20736344
- SSDEEP
  
  384:SOgGIbRJpai9c49Wigp5/y+ixe1+B6BDR+v+I7J3SvwKF58o2iU+:GjgiGxy+is1M6BDRK97J3+ZFWo2iU+
Score

8^/10

discovery persistence privilege_escalation
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

AppInit DLLs

Privilege Escalation

Event Triggered Execution

AppInit DLLs

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistenceprivilege_escalation

behavioral2

discoverypersistenceprivilege_escalation