cb9411230c903f1df0b7d44bed1efe29da8605fdb29d589bdc3fa7d8d74f9768 | Triage

Sharing

General

Target

1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118
Size

124KB
Sample

240701-kyq8taserb
MD5

1ab12ca1fb9180ff8fac937066e843a5
SHA1

b01b189363d4c5c25af763abd3b769178ec43abd
SHA256

cb9411230c903f1df0b7d44bed1efe29da8605fdb29d589bdc3fa7d8d74f9768
SHA512

804bd6ad7a3084c42ef3ce13f9de270d8e499d7f530c422bb3a6f822571296ee85700ebd8fda78eb5f2b86bebd641d11b430211cf47e02f2a4514202f94649ed
SSDEEP

3072:KV4nc90YgA4ZKsup/mnU9xw0W/Pgd+vI14:c4nciYg9nUDq/PE4

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118
- Size
  
  124KB
- MD5
  
  1ab12ca1fb9180ff8fac937066e843a5
- SHA1
  
  b01b189363d4c5c25af763abd3b769178ec43abd
- SHA256
  
  cb9411230c903f1df0b7d44bed1efe29da8605fdb29d589bdc3fa7d8d74f9768
- SHA512
  
  804bd6ad7a3084c42ef3ce13f9de270d8e499d7f530c422bb3a6f822571296ee85700ebd8fda78eb5f2b86bebd641d11b430211cf47e02f2a4514202f94649ed
- SSDEEP
  
  3072:KV4nc90YgA4ZKsup/mnU9xw0W/Pgd+vI14:c4nciYg9nUDq/PE4
Score

10^/10

evasion persistence trojan
- Modifies firewall policy service
  evasion
- Windows security bypass
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan