b9e6714b799f17140cdea8e4720b9e15e5699125ca02b2cf364b4308407423b5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

161faa56aafd4286908d15662f934bf8_JaffaCakes118
Size

155KB
Sample

241005-ev9m4ayhlh
MD5

161faa56aafd4286908d15662f934bf8
SHA1

ad10a0a066a475e56dbd3e1fef47753841f040c3
SHA256

b9e6714b799f17140cdea8e4720b9e15e5699125ca02b2cf364b4308407423b5
SHA512

8adcec1697bf768563c73b12ebfd8081b318c88c06b9d4fed070d350f7ac764f61003bf4dd4b41fb3f2a0a98e7c2d773eeda6c27af64c7f1919d82f56a7061a5
SSDEEP

3072:0QfYsrMvfk7x3nj81ytAjLBRXNLu9mtYNfOBC9MS235ONfi6vmscnd7a4:0QfYsb79j8EWQB8CK3pOVi6+Pd7a

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Targets

- Target
  
  161faa56aafd4286908d15662f934bf8_JaffaCakes118
- Size
  
  155KB
- MD5
  
  161faa56aafd4286908d15662f934bf8
- SHA1
  
  ad10a0a066a475e56dbd3e1fef47753841f040c3
- SHA256
  
  b9e6714b799f17140cdea8e4720b9e15e5699125ca02b2cf364b4308407423b5
- SHA512
  
  8adcec1697bf768563c73b12ebfd8081b318c88c06b9d4fed070d350f7ac764f61003bf4dd4b41fb3f2a0a98e7c2d773eeda6c27af64c7f1919d82f56a7061a5
- SSDEEP
  
  3072:0QfYsrMvfk7x3nj81ytAjLBRXNLu9mtYNfOBC9MS235ONfi6vmscnd7a4:0QfYsb79j8EWQB8CK3pOVi6+Pd7a
Score

7^/10

discovery persistence privilege_escalation
- Deletes itself
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Component Object Model Hijacking

Privilege Escalation

Event Triggered Execution

Component Object Model Hijacking

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoverypersistenceprivilege_escalation