82bcaf8b98de0e6dedf7234d359e65d6a3ca318a0ce9d157ed7e33944d666483 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0f5c1ef3414b602aaaa51e100ba9beee_JaffaCakes118
Size

1.2MB
Sample

240503-bvhyladg34
MD5

0f5c1ef3414b602aaaa51e100ba9beee
SHA1

164762e4f115af898d871c7333da6e14138e737c
SHA256

82bcaf8b98de0e6dedf7234d359e65d6a3ca318a0ce9d157ed7e33944d666483
SHA512

8908c3179fd942a37edc69443ff56cc9242b591ef73f26c95d923a1a8fecd4258ec125563033e97c6bb5c35accc14573b3b54a899e52f39e7eea5081c87789e1
SSDEEP

12288:fQVgRuk236YfvMPfHKPXU2T9f2PPFClbSn4EdlvV12GrNfLC75ByFio7BiJH8LII:bUHKSEPPt490qSz/vV1nGSFyc0NZ3c

Score

7^/10

discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  0f5c1ef3414b602aaaa51e100ba9beee_JaffaCakes118
- Size
  
  1.2MB
- MD5
  
  0f5c1ef3414b602aaaa51e100ba9beee
- SHA1
  
  164762e4f115af898d871c7333da6e14138e737c
- SHA256
  
  82bcaf8b98de0e6dedf7234d359e65d6a3ca318a0ce9d157ed7e33944d666483
- SHA512
  
  8908c3179fd942a37edc69443ff56cc9242b591ef73f26c95d923a1a8fecd4258ec125563033e97c6bb5c35accc14573b3b54a899e52f39e7eea5081c87789e1
- SSDEEP
  
  12288:fQVgRuk236YfvMPfHKPXU2T9f2PPFClbSn4EdlvV12GrNfLC75ByFio7BiJH8LII:bUHKSEPPt490qSz/vV1nGSFyc0NZ3c
Score

7^/10

discovery evasion persistence trojan
- Registers COM server for autorun
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencetrojan

behavioral2

evasionpersistencetrojan