34afc45610acd3da38d3e0dce2188c4e497e022c4a9c682835e1d0dad8db3377 | Triage

Sharing

General

Target

162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118
Size

140KB
Sample

240627-qrxpxatdla
MD5

162c4353341d051b56846e3ba5bfe3f7
SHA1

cc954332519cdf44aa3d0f41713099d9c875e7d6
SHA256

34afc45610acd3da38d3e0dce2188c4e497e022c4a9c682835e1d0dad8db3377
SHA512

3e542b971cfb84465e70ae13c0ba93e8582aaab429982ff6eed106e5801ba2e563fd8c107baa9081adc602b120ed7362dc9cd3f5c58bbf22b36a05bb9e636832
SSDEEP

1536:YPqQV/AQGO9pfU+TGTrhfMgVatRsa6FFjbsg0vea52eGs7Wcp0yJGmhZoJb1i+:bPYp5TGvlM9D0+7ea5FoyJxoXi+

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118
- Size
  
  140KB
- MD5
  
  162c4353341d051b56846e3ba5bfe3f7
- SHA1
  
  cc954332519cdf44aa3d0f41713099d9c875e7d6
- SHA256
  
  34afc45610acd3da38d3e0dce2188c4e497e022c4a9c682835e1d0dad8db3377
- SHA512
  
  3e542b971cfb84465e70ae13c0ba93e8582aaab429982ff6eed106e5801ba2e563fd8c107baa9081adc602b120ed7362dc9cd3f5c58bbf22b36a05bb9e636832
- SSDEEP
  
  1536:YPqQV/AQGO9pfU+TGTrhfMgVatRsa6FFjbsg0vea52eGs7Wcp0yJGmhZoJb1i+:bPYp5TGvlM9D0+7ea5FoyJxoXi+
Score

10^/10

evasion persistence
- Modifies security service
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence