794625d4c16735b25963b5d21dee789a8c9c3c15321aa6f5be9b94d1b29dc128 | Triage

Sharing

General

Target

2b446c9d4c3531178f3aa9a9d3da0aee_JaffaCakes118
Size

28KB
Sample

240708-gytr6ayamc
MD5

2b446c9d4c3531178f3aa9a9d3da0aee
SHA1

4884778d4fb10c3ef1b3f8e99e58f1f493f30db6
SHA256

794625d4c16735b25963b5d21dee789a8c9c3c15321aa6f5be9b94d1b29dc128
SHA512

79877dd7ceff78a98b47a9cfaf9e80ac798da48d53c751696077e21cbc176ced5517e1b4418ecccabf06d4679f25634eb273e5ba53678cd1d46f5e9ba6badfce
SSDEEP

768:x5RyOB0kMTTqJ93k7AWwkBYVxzf7MZ/1JR5+r:x5RY5Tw3rWAod1JfE

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  2b446c9d4c3531178f3aa9a9d3da0aee_JaffaCakes118
- Size
  
  28KB
- MD5
  
  2b446c9d4c3531178f3aa9a9d3da0aee
- SHA1
  
  4884778d4fb10c3ef1b3f8e99e58f1f493f30db6
- SHA256
  
  794625d4c16735b25963b5d21dee789a8c9c3c15321aa6f5be9b94d1b29dc128
- SHA512
  
  79877dd7ceff78a98b47a9cfaf9e80ac798da48d53c751696077e21cbc176ced5517e1b4418ecccabf06d4679f25634eb273e5ba53678cd1d46f5e9ba6badfce
- SSDEEP
  
  768:x5RyOB0kMTTqJ93k7AWwkBYVxzf7MZ/1JR5+r:x5RY5Tw3rWAod1JfE
Score

8^/10

evasion persistence privilege_escalation
- Disables Task Manager via registry modification
  evasion
- Modifies Windows Firewall
  evasion
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

evasionpersistenceprivilege_escalation