49d3433a94a5861fe38cebd288022d54737287fb72e8cbb55b2ee5d7a399d629 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ef7f3b40865cb96ed53da14600e9180b_JaffaCakes118
Size

96KB
Sample

240921-ldh75svfqj
MD5

ef7f3b40865cb96ed53da14600e9180b
SHA1

2fe8ed8eaf3426fd3e4f1a0b32dcc19ca7a95ace
SHA256

49d3433a94a5861fe38cebd288022d54737287fb72e8cbb55b2ee5d7a399d629
SHA512

c9c4f75a790c112c81724dea6e7145d5e3b49373b93009db7a7753e4b8d31c6db14cc9293cd2c3019b109115a0a4ff3ecfb329950fa371741fd69809dc4b5ef2
SSDEEP

1536:bt9er2PMC9LzlyMdx/+Tt52VNXNdoXSeQPWbCj8/KzJohWGBgmQB:ba8MC9Lz3dx/+TCEhQObM8CzJoc4gmQ

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Targets

- Target
  
  ef7f3b40865cb96ed53da14600e9180b_JaffaCakes118
- Size
  
  96KB
- MD5
  
  ef7f3b40865cb96ed53da14600e9180b
- SHA1
  
  2fe8ed8eaf3426fd3e4f1a0b32dcc19ca7a95ace
- SHA256
  
  49d3433a94a5861fe38cebd288022d54737287fb72e8cbb55b2ee5d7a399d629
- SHA512
  
  c9c4f75a790c112c81724dea6e7145d5e3b49373b93009db7a7753e4b8d31c6db14cc9293cd2c3019b109115a0a4ff3ecfb329950fa371741fd69809dc4b5ef2
- SSDEEP
  
  1536:bt9er2PMC9LzlyMdx/+Tt52VNXNdoXSeQPWbCj8/KzJohWGBgmQB:ba8MC9Lz3dx/+TCEhQObM8CzJoc4gmQ
Score

8^/10

discovery persistence privilege_escalation
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

AppInit DLLs

Privilege Escalation

Event Triggered Execution

AppInit DLLs

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistenceprivilege_escalation

behavioral2

discoverypersistenceprivilege_escalation