9c3bb8ebaa6719d2cb7247ae6f093c1a8f7ed7ab1d4877bc7be58d0f734e37d9 | Triage

Sharing

General

Target

a6600bbc94769a3917bd904750eb3419_JaffaCakes118
Size

347KB
Sample

240613-tea7xszaqm
MD5

a6600bbc94769a3917bd904750eb3419
SHA1

859af2db53e25db37da6f8331ee59f1e5b81276e
SHA256

9c3bb8ebaa6719d2cb7247ae6f093c1a8f7ed7ab1d4877bc7be58d0f734e37d9
SHA512

4a36b69b53842dd5490f1f8fbefefc10cc822f4bb3e93e27bb14c86c49220b9469c10fa650f0ecd1d543495857b35839e33fdf6c245df4da6fc319d90dab6dc4
SSDEEP

3072:JUgYpTd8fBtpAZc+sixKLs+MadpD5SA/OULWjJJvKVUa27t1C4ScGFiX3d:qTCBL4UAWD5h/OPHyO5hScGFmd

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  a6600bbc94769a3917bd904750eb3419_JaffaCakes118
- Size
  
  347KB
- MD5
  
  a6600bbc94769a3917bd904750eb3419
- SHA1
  
  859af2db53e25db37da6f8331ee59f1e5b81276e
- SHA256
  
  9c3bb8ebaa6719d2cb7247ae6f093c1a8f7ed7ab1d4877bc7be58d0f734e37d9
- SHA512
  
  4a36b69b53842dd5490f1f8fbefefc10cc822f4bb3e93e27bb14c86c49220b9469c10fa650f0ecd1d543495857b35839e33fdf6c245df4da6fc319d90dab6dc4
- SSDEEP
  
  3072:JUgYpTd8fBtpAZc+sixKLs+MadpD5SA/OULWjJJvKVUa27t1C4ScGFiX3d:qTCBL4UAWD5h/OPHyO5hScGFmd
Score

10^/10

evasion persistence trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan