151fc073b2f04971f8a0337d81aed266e3322f5282555f46e96abdbab0f0dace | Triage

Sharing

General

Target

9c6f32c031950cfd5d9b97c838dd7905_JaffaCakes118
Size

2.7MB
Sample

240611-arhmzsxckr
MD5

9c6f32c031950cfd5d9b97c838dd7905
SHA1

ee51a10f07a379ca47a909b314aca5f70dc832bd
SHA256

151fc073b2f04971f8a0337d81aed266e3322f5282555f46e96abdbab0f0dace
SHA512

dffa818ae32b7039da4490247e0284442e84486c7b7ed27750d6eb70fe55d5e681a32d2687148238e57c04962a8fcee409d7383c02c5b1e3c4681b6d418c5f86
SSDEEP

49152:FMQYUbyuoja3HnY6rTpbp3J2YZ05HltMgsmdRUXFoQy2:FQUbJOa34apbp3J2LFCHoD

Score

6^/10

evasion

Malware Config

Targets

- Target
  
  9c6f32c031950cfd5d9b97c838dd7905_JaffaCakes118
- Size
  
  2.7MB
- MD5
  
  9c6f32c031950cfd5d9b97c838dd7905
- SHA1
  
  ee51a10f07a379ca47a909b314aca5f70dc832bd
- SHA256
  
  151fc073b2f04971f8a0337d81aed266e3322f5282555f46e96abdbab0f0dace
- SHA512
  
  dffa818ae32b7039da4490247e0284442e84486c7b7ed27750d6eb70fe55d5e681a32d2687148238e57c04962a8fcee409d7383c02c5b1e3c4681b6d418c5f86
- SSDEEP
  
  49152:FMQYUbyuoja3HnY6rTpbp3J2YZ05HltMgsmdRUXFoQy2:FQUbJOa34apbp3J2LFCHoD
Score

6^/10

evasion
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2