72869499ac61e6c638736141ef29f550d780a0ceb77c479bbf9881f243dca9fa | Triage

Sharing

General

Target

4157cf8d0386935dbe571b9f0e76ba93_JaffaCakes118
Size

837KB
Sample

240514-nnry5sdg2t
MD5

4157cf8d0386935dbe571b9f0e76ba93
SHA1

18870afb3e39f9a10df42b83585e96740b32797b
SHA256

72869499ac61e6c638736141ef29f550d780a0ceb77c479bbf9881f243dca9fa
SHA512

40150b367d9727b5d83bce7434a1d7e9ddf83bae1f55518915ef7e9e501fb77a0f9b4e1cc79b999e79072f5f62b6b6a80a5ef9bc563af878a436805db0ede21b
SSDEEP

12288:UZWtI6RkherQZb+md4w1UieZJys73dOvXDpNjNe8TOB0H:UuhaherQZb+md4wmieZJ8NI8TOM

Score

10^/10

evasion execution persistence

Malware Config

Targets

- Target
  
  4157cf8d0386935dbe571b9f0e76ba93_JaffaCakes118
- Size
  
  837KB
- MD5
  
  4157cf8d0386935dbe571b9f0e76ba93
- SHA1
  
  18870afb3e39f9a10df42b83585e96740b32797b
- SHA256
  
  72869499ac61e6c638736141ef29f550d780a0ceb77c479bbf9881f243dca9fa
- SHA512
  
  40150b367d9727b5d83bce7434a1d7e9ddf83bae1f55518915ef7e9e501fb77a0f9b4e1cc79b999e79072f5f62b6b6a80a5ef9bc563af878a436805db0ede21b
- SSDEEP
  
  12288:UZWtI6RkherQZb+md4w1UieZJys73dOvXDpNjNe8TOB0H:UuhaherQZb+md4wmieZJ8NI8TOM
Score

10^/10

evasion execution persistence
- Disables service(s)
  evasion execution
- Modifies visibility of file extensions in Explorer
  evasion
- Blocks application from running via registry modification
  Adds application to list of disallowed applications.
  evasion
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

System Services

Service Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

evasionexecutionpersistence

behavioral2

evasionexecutionpersistence