80f26b4a241cc75f8677d3021dec0454a7557c9b5d9a0d1ddc5ab6b9c5da7304 | Triage

Sharing

General

Target

6137c93b084aee6ce49fe56ab35c5a55_JaffaCakes118
Size

234KB
Sample

240721-yv5hxsvcnl
MD5

6137c93b084aee6ce49fe56ab35c5a55
SHA1

5332f71b391ada36390399af3e6873a78532f7df
SHA256

80f26b4a241cc75f8677d3021dec0454a7557c9b5d9a0d1ddc5ab6b9c5da7304
SHA512

65f2a0a142c4f56f199f39ccc3ad560a69a6f63a72813165177bf9ccf8fe88be0c0970749ce3aeccb15f6cc0c161775c753820db11d460c18bc3764aa4e75982
SSDEEP

6144:A6Gq1/VE4tKQ14jDD/YE5fLrDFPKX5kCzFHKQeu8NcRS4:Ac/VVp14jP/YE5fLrDtKXqCzFHKQeu8y

Score

10^/10

evasion

Malware Config

Targets

- Target
  
  6137c93b084aee6ce49fe56ab35c5a55_JaffaCakes118
- Size
  
  234KB
- MD5
  
  6137c93b084aee6ce49fe56ab35c5a55
- SHA1
  
  5332f71b391ada36390399af3e6873a78532f7df
- SHA256
  
  80f26b4a241cc75f8677d3021dec0454a7557c9b5d9a0d1ddc5ab6b9c5da7304
- SHA512
  
  65f2a0a142c4f56f199f39ccc3ad560a69a6f63a72813165177bf9ccf8fe88be0c0970749ce3aeccb15f6cc0c161775c753820db11d460c18bc3764aa4e75982
- SSDEEP
  
  6144:A6Gq1/VE4tKQ14jDD/YE5fLrDFPKX5kCzFHKQeu8NcRS4:Ac/VVp14jP/YE5fLrDtKXqCzFHKQeu8y
Score

10^/10

evasion
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Uses the VBS compiler for execution
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2