bbc0b759438c0253096a5ef04db85dd822ecb49a2d61c139ecd585a3509eb031 | Triage

Sharing

General

Target

fef04aa20b216f1aa67ecfa07eee5103_JaffaCakes118
Size

110KB
Sample

240929-t671za1hmr
MD5

fef04aa20b216f1aa67ecfa07eee5103
SHA1

7a0d2f381fda021f70408c646bb839e03889e5d0
SHA256

bbc0b759438c0253096a5ef04db85dd822ecb49a2d61c139ecd585a3509eb031
SHA512

e36125a5fbfcc8e4f04c20f7186e0f67063d14795e0880f0adb3dc20c9b7dbba7cf15b3a8b9cd136e6f73177a04a0fd645e9d3c780889dbb88579a5ad43fb27b
SSDEEP

3072:SWwDHP5VTvmKT7CGMNeBdfrPe4j0UlV9UjBt:SZbPDvR7BtL1j0UroB

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  fef04aa20b216f1aa67ecfa07eee5103_JaffaCakes118
- Size
  
  110KB
- MD5
  
  fef04aa20b216f1aa67ecfa07eee5103
- SHA1
  
  7a0d2f381fda021f70408c646bb839e03889e5d0
- SHA256
  
  bbc0b759438c0253096a5ef04db85dd822ecb49a2d61c139ecd585a3509eb031
- SHA512
  
  e36125a5fbfcc8e4f04c20f7186e0f67063d14795e0880f0adb3dc20c9b7dbba7cf15b3a8b9cd136e6f73177a04a0fd645e9d3c780889dbb88579a5ad43fb27b
- SSDEEP
  
  3072:SWwDHP5VTvmKT7CGMNeBdfrPe4j0UlV9UjBt:SZbPDvR7BtL1j0UroB
Score

7^/10

discovery persistence
- Boot or Logon Autostart Execution: Print Processors
  Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Print Processors

Privilege Escalation

Boot or Logon Autostart Execution

Print Processors

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence