f654942b53f947d9cb33e7091b7eca280a590f8b9162450883bd008bb57aff6c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5fab7cfa3dc599941663ffc052def8a0_JaffaCakes118
Size

810KB
Sample

240720-jw9rpstckm
MD5

5fab7cfa3dc599941663ffc052def8a0
SHA1

be7b8f9d40f8e089741f412085e1ad6be6a4ebaa
SHA256

f654942b53f947d9cb33e7091b7eca280a590f8b9162450883bd008bb57aff6c
SHA512

b8a3ec584eaec1f9a69087d4554e8cc75e2bcc226772e9731f8ade0aa4be99fbc688738aa988f47d762d028a107466540671ce554346ee71f8149649e4c7cfdf
SSDEEP

12288:j48OUL48hA1YViCkS0d5EOc27QkzU44ODFQXf7dL32cnBpoz2vyaE6qRRe3OT83p:MUDv8R5EOlEkY44OO5Lmz2KeWkkj74F

Score

7^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  5fab7cfa3dc599941663ffc052def8a0_JaffaCakes118
- Size
  
  810KB
- MD5
  
  5fab7cfa3dc599941663ffc052def8a0
- SHA1
  
  be7b8f9d40f8e089741f412085e1ad6be6a4ebaa
- SHA256
  
  f654942b53f947d9cb33e7091b7eca280a590f8b9162450883bd008bb57aff6c
- SHA512
  
  b8a3ec584eaec1f9a69087d4554e8cc75e2bcc226772e9731f8ade0aa4be99fbc688738aa988f47d762d028a107466540671ce554346ee71f8149649e4c7cfdf
- SSDEEP
  
  12288:j48OUL48hA1YViCkS0d5EOc27QkzU44ODFQXf7dL32cnBpoz2vyaE6qRRe3OT83p:MUDv8R5EOlEkY44OO5Lmz2KeWkkj74F
Score

7^/10

evasion persistence trojan
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan