9dd6f8cf4398797b91cf3fb2a5a963f21cf7be59dc1d57a56b1550f308547d36 | Triage

Sharing

General

Target

2f23457525fbf8f07e4ae0fdad832697_JaffaCakes118
Size

39KB
Sample

241009-l1995sxcqr
MD5

2f23457525fbf8f07e4ae0fdad832697
SHA1

a53918762bd311d66754aff9ca71e0a3b4fb9699
SHA256

9dd6f8cf4398797b91cf3fb2a5a963f21cf7be59dc1d57a56b1550f308547d36
SHA512

b0565cb38e0abea79eaf461256cc7a139619a64f1e1d1b5cd8e98ae6cc0f5d75cb18af856357ac2f665cccdb9646ee8ed1aa807651f4de968e82061621e4b323
SSDEEP

768:YpfG5My8Ox9poEJbuLdPZgSxbi23y9NT5X5Kb2Biq:EfPy8+JbuVe2bCH5Xq2Biq

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Targets

- Target
  
  2f23457525fbf8f07e4ae0fdad832697_JaffaCakes118
- Size
  
  39KB
- MD5
  
  2f23457525fbf8f07e4ae0fdad832697
- SHA1
  
  a53918762bd311d66754aff9ca71e0a3b4fb9699
- SHA256
  
  9dd6f8cf4398797b91cf3fb2a5a963f21cf7be59dc1d57a56b1550f308547d36
- SHA512
  
  b0565cb38e0abea79eaf461256cc7a139619a64f1e1d1b5cd8e98ae6cc0f5d75cb18af856357ac2f665cccdb9646ee8ed1aa807651f4de968e82061621e4b323
- SSDEEP
  
  768:YpfG5My8Ox9poEJbuLdPZgSxbi23y9NT5X5Kb2Biq:EfPy8+JbuVe2bCH5Xq2Biq
Score

8^/10

discovery persistence privilege_escalation
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

AppInit DLLs

Privilege Escalation

Event Triggered Execution

AppInit DLLs

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoverypersistenceprivilege_escalation