c11e6b4b73934ec0f3fe87f82a13bb930b1b0cc42fcd1839303b42b0a7a03336 | Triage

Sharing

General

Target

33b6c459b27b8bc23cd43f32b2463568_JaffaCakes118
Size

76KB
Sample

240710-hjdytssgjk
MD5

33b6c459b27b8bc23cd43f32b2463568
SHA1

cdbd5609305f813c036863d4d40ce729dcb5d03f
SHA256

c11e6b4b73934ec0f3fe87f82a13bb930b1b0cc42fcd1839303b42b0a7a03336
SHA512

b0a2e1d3a6295be91a5fefef242a290438970e2ca547202278a055c62a19446b08b4ae4ad14e6118edab9ee257771fc2fd3484b638562c8524c0422fa5b4eaaa
SSDEEP

768:cIEzydyLDFQoP2ByoFQxpIY5iJhmw12QLp3jJvemmk88ynNsttlyJz+:tMVuouBfF2pIUiTfompzJvemmlnMlyJy

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  33b6c459b27b8bc23cd43f32b2463568_JaffaCakes118
- Size
  
  76KB
- MD5
  
  33b6c459b27b8bc23cd43f32b2463568
- SHA1
  
  cdbd5609305f813c036863d4d40ce729dcb5d03f
- SHA256
  
  c11e6b4b73934ec0f3fe87f82a13bb930b1b0cc42fcd1839303b42b0a7a03336
- SHA512
  
  b0a2e1d3a6295be91a5fefef242a290438970e2ca547202278a055c62a19446b08b4ae4ad14e6118edab9ee257771fc2fd3484b638562c8524c0422fa5b4eaaa
- SSDEEP
  
  768:cIEzydyLDFQoP2ByoFQxpIY5iJhmw12QLp3jJvemmk88ynNsttlyJz+:tMVuouBfF2pIUiTfompzJvemmlnMlyJy
Score

10^/10

evasion persistence
- Modifies firewall policy service
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence