4ecf06a71a3a262730b5fba09d98983f5e6f2b2a50cd3a284e2ee805a2473bc5 | Triage

Sharing

General

Target

f08dbb1ef6ef6e6cdf6619e5e5e20648_JaffaCakes118
Size

100KB
Sample

240921-y9xrmasake
MD5

f08dbb1ef6ef6e6cdf6619e5e5e20648
SHA1

82c7042b8023e9bcdd0b6960a5f7a7e78d824426
SHA256

4ecf06a71a3a262730b5fba09d98983f5e6f2b2a50cd3a284e2ee805a2473bc5
SHA512

db995b67b3dadd4940589ba9b96159282b0f37b067c56424cf9669738b71ee8323a32d16dbea44e063dd5139bed31383cc31c3e944612a0a8edb3fa88b16ad57
SSDEEP

3072:rHLuLD6HHuglTFzjWaZC6POM5kykTsRgo7kY:rHieHHlhvWaZC+38FY

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Targets

- Target
  
  f08dbb1ef6ef6e6cdf6619e5e5e20648_JaffaCakes118
- Size
  
  100KB
- MD5
  
  f08dbb1ef6ef6e6cdf6619e5e5e20648
- SHA1
  
  82c7042b8023e9bcdd0b6960a5f7a7e78d824426
- SHA256
  
  4ecf06a71a3a262730b5fba09d98983f5e6f2b2a50cd3a284e2ee805a2473bc5
- SHA512
  
  db995b67b3dadd4940589ba9b96159282b0f37b067c56424cf9669738b71ee8323a32d16dbea44e063dd5139bed31383cc31c3e944612a0a8edb3fa88b16ad57
- SSDEEP
  
  3072:rHLuLD6HHuglTFzjWaZC6POM5kykTsRgo7kY:rHieHHlhvWaZC+38FY
Score

8^/10

discovery persistence privilege_escalation
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

AppInit DLLs

Privilege Escalation

Event Triggered Execution

AppInit DLLs

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistenceprivilege_escalation

behavioral2

discoverypersistenceprivilege_escalation