6a6f8029857a2ef3f75c9651ede0b08089212082fc965132baf82d5b85b18cbc | Triage

Sharing

General

Target

49c9983935cc0af7407a6023249ebd35_JaffaCakes118
Size

2KB
Sample

240715-ppjvla1dpr
MD5

49c9983935cc0af7407a6023249ebd35
SHA1

33154f362544425775e88ac983b11f3ba45c76c4
SHA256

6a6f8029857a2ef3f75c9651ede0b08089212082fc965132baf82d5b85b18cbc
SHA512

459f1cae341eaa77f45b0b456bc5b77a9084a190669f5ecb0fe8f19ccd6aac2a75f434c73b9d10d74161598f02fed376b964b2fbc1fea2f03f51b2a5a84cc9cc

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  49c9983935cc0af7407a6023249ebd35_JaffaCakes118
- Size
  
  2KB
- MD5
  
  49c9983935cc0af7407a6023249ebd35
- SHA1
  
  33154f362544425775e88ac983b11f3ba45c76c4
- SHA256
  
  6a6f8029857a2ef3f75c9651ede0b08089212082fc965132baf82d5b85b18cbc
- SHA512
  
  459f1cae341eaa77f45b0b456bc5b77a9084a190669f5ecb0fe8f19ccd6aac2a75f434c73b9d10d74161598f02fed376b964b2fbc1fea2f03f51b2a5a84cc9cc
Score

8^/10

persistence
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2