11157b0a42235c1f94ee8e65208da942a35b05cd663d960ba30fca570ea5fd80 | Triage

Sharing

General

Target

1518bb863f8b1be32882db74425ed3e7_JaffaCakes118
Size

46KB
Sample

240627-hx7hasxhke
MD5

1518bb863f8b1be32882db74425ed3e7
SHA1

c0ab73fc43a1258e7490d2cb414d88fb3e8c715e
SHA256

11157b0a42235c1f94ee8e65208da942a35b05cd663d960ba30fca570ea5fd80
SHA512

291852dd744881a21b3ebbff72dfd6beee8c7678098b6530aa3c7d5e73c42312e0d909b318e44ddaf913a95b2053933513c18ed3ca8f4c98e5a70c7e4d63d5ea
SSDEEP

768:KEqpwWy253Qqdva7yXla2z/PF0mfRIL4GDihp44WaHZimIgFEEew:1iG253QQ/3bFFmkGWT4bmVtew

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  1518bb863f8b1be32882db74425ed3e7_JaffaCakes118
- Size
  
  46KB
- MD5
  
  1518bb863f8b1be32882db74425ed3e7
- SHA1
  
  c0ab73fc43a1258e7490d2cb414d88fb3e8c715e
- SHA256
  
  11157b0a42235c1f94ee8e65208da942a35b05cd663d960ba30fca570ea5fd80
- SHA512
  
  291852dd744881a21b3ebbff72dfd6beee8c7678098b6530aa3c7d5e73c42312e0d909b318e44ddaf913a95b2053933513c18ed3ca8f4c98e5a70c7e4d63d5ea
- SSDEEP
  
  768:KEqpwWy253Qqdva7yXla2z/PF0mfRIL4GDihp44WaHZimIgFEEew:1iG253QQ/3bFFmkGWT4bmVtew
Score

10^/10

evasion persistence
- Modifies firewall policy service
  evasion
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence