12683afbc8fd525a111302881fdc97aaa596c29b942fd9804a57aa26ae2e650c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

29dd48a358fc7be93c82a54d1ff41cf0_JaffaCakes118
Size

752KB
Sample

240707-knh5fsxhmk
MD5

29dd48a358fc7be93c82a54d1ff41cf0
SHA1

90f0a7bba84e2f5581482ac5b222bd376d3e9ecd
SHA256

12683afbc8fd525a111302881fdc97aaa596c29b942fd9804a57aa26ae2e650c
SHA512

341a510a0592b20c2c3c43ad92e63e4d8b708e7d42247283f6ea1060b70b7af387936b24441de100f2fe9282c4d2a82bb7646d862a012b302219a621963f2b89
SSDEEP

12288:tx6/jgo3hgNYxvC6PdiZZU89dsYrEkLCqKcyX73jDo1PxfZm94hnOJhZYOWRf2zx:P6/co3LvXda28LsOLscyzj8PxfS2nOJ5

Score

10^/10

evasion

Malware Config

Targets

- Target
  
  HB_Rescue9850831_ljh.EXE
- Size
  
  1016KB
- MD5
  
  9c26d06f1867768c22a38d995c75605a
- SHA1
  
  6f841bea61e61f4274a72d58f5f860ac72552c26
- SHA256
  
  55fc7c754c88ab1063a51fb915143eb27a1e5efd1034bfc8f142826e4cbbfd6d
- SHA512
  
  a269b1877ec8121d5fbe0d437e9bed37a55960909f38254cceb38670be18adece51c484db294dc103124bafabeedd74a3520ca6818619c3a14813684111bb6bd
- SSDEEP
  
  24576:mbn04IiQ96vm1lwHoHve72fM0Ja/yg1t+My2Ix:mQiiwIHW0281Dx
Score

10^/10

evasion
- Modifies firewall policy service
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2