ff133b634efa3defb049bea0f697f8ad1349b9ea746f9c8ff8d4cb4007c88cf3 | Triage

Sharing

General

Target

62601be46af4e1d8d54886eed720bc02_JaffaCakes118
Size

1.8MB
Sample

240722-jqsagawdrh
MD5

62601be46af4e1d8d54886eed720bc02
SHA1

140b3ded92999d3a066d046819165d14ae8c6f06
SHA256

ff133b634efa3defb049bea0f697f8ad1349b9ea746f9c8ff8d4cb4007c88cf3
SHA512

b82aafaf4f29495fd4c30ed5d759ca2e1cce7c065bda5604547a9e10e0a7b4be81f5fc5c3c2310b334382cc0ad322610e462ee9fa343b7fe04a058add4aaf928
SSDEEP

49152:eXVkTlpKYUGDL1QpLhPR95F3t/FGb7eINrhse2bxaS:eXValpKYtnmdPRXjFGH/Nrk1f

Score

8^/10

evasion execution persistence privilege_escalation

Malware Config

Targets

- Target
  
  62601be46af4e1d8d54886eed720bc02_JaffaCakes118
- Size
  
  1.8MB
- MD5
  
  62601be46af4e1d8d54886eed720bc02
- SHA1
  
  140b3ded92999d3a066d046819165d14ae8c6f06
- SHA256
  
  ff133b634efa3defb049bea0f697f8ad1349b9ea746f9c8ff8d4cb4007c88cf3
- SHA512
  
  b82aafaf4f29495fd4c30ed5d759ca2e1cce7c065bda5604547a9e10e0a7b4be81f5fc5c3c2310b334382cc0ad322610e462ee9fa343b7fe04a058add4aaf928
- SSDEEP
  
  49152:eXVkTlpKYUGDL1QpLhPR95F3t/FGb7eINrhse2bxaS:eXValpKYtnmdPRXjFGH/Nrk1f
Score

8^/10

evasion execution persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Stops running service(s)
  evasion execution
- Uses Session Manager for persistence
  Creates Session Manager registry key to run executable early in system boot.
  persistence
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

evasionexecutionpersistenceprivilege_escalation

behavioral2

evasionexecutionpersistenceprivilege_escalation