3391c6f8712dc4f51479e034ade093e6f5e8b4ee737fdb9491912c5d9065ebdd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6ef8d01b15df06ae505b64bedd065b1f_JaffaCakes118
Size

1.2MB
Sample

240524-stl3asae4s
MD5

6ef8d01b15df06ae505b64bedd065b1f
SHA1

a8784d1b5213bed5ae26303156267c6f66226fd6
SHA256

3391c6f8712dc4f51479e034ade093e6f5e8b4ee737fdb9491912c5d9065ebdd
SHA512

5c6aae4c8dc85c978ec2dcaeb7099862e29deea953d6f91b2abb83f531ea97a0ab5c98b38a1f4dddc21dea7aea367081561efc0735b078a05c2d074bc57ac8f7
SSDEEP

12288:GkNgwJ/sYz8kSwLClQNws8xpfjsyDzw9WOw+pIKFSJ+YLydvFQ5amdzA/wHPBayE:GkNgw1b1ClWws8xpflPwPFSadBmmkHa

Score

7^/10

discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  6ef8d01b15df06ae505b64bedd065b1f_JaffaCakes118
- Size
  
  1.2MB
- MD5
  
  6ef8d01b15df06ae505b64bedd065b1f
- SHA1
  
  a8784d1b5213bed5ae26303156267c6f66226fd6
- SHA256
  
  3391c6f8712dc4f51479e034ade093e6f5e8b4ee737fdb9491912c5d9065ebdd
- SHA512
  
  5c6aae4c8dc85c978ec2dcaeb7099862e29deea953d6f91b2abb83f531ea97a0ab5c98b38a1f4dddc21dea7aea367081561efc0735b078a05c2d074bc57ac8f7
- SSDEEP
  
  12288:GkNgwJ/sYz8kSwLClQNws8xpfjsyDzw9WOw+pIKFSJ+YLydvFQ5amdzA/wHPBayE:GkNgw1b1ClWws8xpflPwPFSadBmmkHa
Score

7^/10

discovery evasion persistence trojan
- Registers COM server for autorun
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencetrojan

behavioral2

evasionpersistencetrojan