a3c05cad5ea0baa6a3c9f36c05146a569aaf3f5a0318ef577068d29e724f6b58 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

097865d191e34368d2b908c8db61842c_JaffaCakes118
Size

63KB
Sample

241002-hx74tstbkl
MD5

097865d191e34368d2b908c8db61842c
SHA1

29826ef868129a6ebffe00322bebcdc76d8d652f
SHA256

a3c05cad5ea0baa6a3c9f36c05146a569aaf3f5a0318ef577068d29e724f6b58
SHA512

a0bf35f5dad36ad2680a76a3c0ea5b453e33084f1a794117e1b4cff5a7f70b4ae0731b8b87898ddc805400e2b0f43148bd535e7ab4b7253eb4e06835fbdc73d5
SSDEEP

1536:xs2fX/RhTMw/kfSTQPvOItKXrRv1t8+lE1K2jYoNFQqdXQ+CjdHh7:xs2fPsw/K8QPv7wbRtt80E8H5qdg+C5h

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Targets

- Target
  
  097865d191e34368d2b908c8db61842c_JaffaCakes118
- Size
  
  63KB
- MD5
  
  097865d191e34368d2b908c8db61842c
- SHA1
  
  29826ef868129a6ebffe00322bebcdc76d8d652f
- SHA256
  
  a3c05cad5ea0baa6a3c9f36c05146a569aaf3f5a0318ef577068d29e724f6b58
- SHA512
  
  a0bf35f5dad36ad2680a76a3c0ea5b453e33084f1a794117e1b4cff5a7f70b4ae0731b8b87898ddc805400e2b0f43148bd535e7ab4b7253eb4e06835fbdc73d5
- SSDEEP
  
  1536:xs2fX/RhTMw/kfSTQPvOItKXrRv1t8+lE1K2jYoNFQqdXQ+CjdHh7:xs2fPsw/K8QPv7wbRtt80E8H5qdg+C5h
Score

8^/10

discovery persistence privilege_escalation
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

AppInit DLLs

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

AppInit DLLs

Netsh Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistenceprivilege_escalation

behavioral2

discoverypersistenceprivilege_escalation