99a197f79b8cbcfb5cdcfb174005d5e83e37845766f9b26c383ad07acf870234 | Triage

Sharing

General

Target

00d6e8c80eda3fa20cea49648388dd71_JaffaCakes118
Size

168KB
Sample

240619-176mvsthrd
MD5

00d6e8c80eda3fa20cea49648388dd71
SHA1

0c7a5ad9a5012a167950896f35152a7599be4824
SHA256

99a197f79b8cbcfb5cdcfb174005d5e83e37845766f9b26c383ad07acf870234
SHA512

e6734461e4f99c18ce881f3c05e89e16c8fd37d7207688dc4cd943404e5154d42d714e0f0a878a17d3afe69729cab5c74f72fb22d96454f58da9f2da463aebba
SSDEEP

3072:F800hh2bRZyTaXsetoe3oOHWhVe+APk5+dZBxKJnqZNccpxLK85qXF:ONhh23yeXloeSVeSkdZXKJniH0oqV

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  00d6e8c80eda3fa20cea49648388dd71_JaffaCakes118
- Size
  
  168KB
- MD5
  
  00d6e8c80eda3fa20cea49648388dd71
- SHA1
  
  0c7a5ad9a5012a167950896f35152a7599be4824
- SHA256
  
  99a197f79b8cbcfb5cdcfb174005d5e83e37845766f9b26c383ad07acf870234
- SHA512
  
  e6734461e4f99c18ce881f3c05e89e16c8fd37d7207688dc4cd943404e5154d42d714e0f0a878a17d3afe69729cab5c74f72fb22d96454f58da9f2da463aebba
- SSDEEP
  
  3072:F800hh2bRZyTaXsetoe3oOHWhVe+APk5+dZBxKJnqZNccpxLK85qXF:ONhh23yeXloeSVeSkdZXKJniH0oqV
Score

10^/10

evasion persistence
- Modifies firewall policy service
  evasion
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence