af958e629c2c6bf48527e5a437b0a6035fee4ea7bd1be636b9a079cd6e22b1ad | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9d1e7be8f119c24c00fc99794b0e2f4a_JaffaCakes118
Size

851KB
Sample

240611-f5nn2swcra
MD5

9d1e7be8f119c24c00fc99794b0e2f4a
SHA1

8724b1e3daea3ab2d6475e2d9a1cfdbbb001f306
SHA256

af958e629c2c6bf48527e5a437b0a6035fee4ea7bd1be636b9a079cd6e22b1ad
SHA512

cd4a4ccbdb50f8c9b20c8355ca2f1c391b285490eb98e8a8f5ac79164084393386611220c95c03e46012ee466cc1e10d7c35d1081874a395544c82a9d7b838e9
SSDEEP

12288:bjNtB5wyurua4sxcfb7PQKTqvyQBDdvcASbqgpPwbiY5PoYPndj8P3OGM6wIcRbl:37uwlHQPtiqKPyiSoIVZhmIR3Gw+E

Score

7^/10

discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  9d1e7be8f119c24c00fc99794b0e2f4a_JaffaCakes118
- Size
  
  851KB
- MD5
  
  9d1e7be8f119c24c00fc99794b0e2f4a
- SHA1
  
  8724b1e3daea3ab2d6475e2d9a1cfdbbb001f306
- SHA256
  
  af958e629c2c6bf48527e5a437b0a6035fee4ea7bd1be636b9a079cd6e22b1ad
- SHA512
  
  cd4a4ccbdb50f8c9b20c8355ca2f1c391b285490eb98e8a8f5ac79164084393386611220c95c03e46012ee466cc1e10d7c35d1081874a395544c82a9d7b838e9
- SSDEEP
  
  12288:bjNtB5wyurua4sxcfb7PQKTqvyQBDdvcASbqgpPwbiY5PoYPndj8P3OGM6wIcRbl:37uwlHQPtiqKPyiSoIVZhmIR3Gw+E
Score

7^/10

discovery evasion persistence trojan
- Registers COM server for autorun
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencetrojan

behavioral2

evasionpersistencetrojan