52ee340152fd8b2aed4497ce08434c437d8b1fb455751897f192577f35545353 | Triage

Sharing

General

Target

658074f0770a6be10048e0c00d4a56af_JaffaCakes118
Size

44KB
Sample

240723-a85tvaydnr
MD5

658074f0770a6be10048e0c00d4a56af
SHA1

019f6890fe89eb79d117a827ea08e5e69d0e8dac
SHA256

52ee340152fd8b2aed4497ce08434c437d8b1fb455751897f192577f35545353
SHA512

373d4155a1e0e3e6b14e45104a456546d5aefba63fbaa2d4a16a258831983db18ed1b7ceac3543911391a00a276f3abd5f22b304086085d7860e2f2ffebe0c7b
SSDEEP

768:wl+RxOpPNN0nhpOA3JfHYBjgPI9di6N4xmhQhIUV5VekqgerEZH4sSnKeGzE:wl/NOx4BOCHBmeUVBerEZ/S/UE

Score

10^/10

evasion persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  658074f0770a6be10048e0c00d4a56af_JaffaCakes118
- Size
  
  44KB
- MD5
  
  658074f0770a6be10048e0c00d4a56af
- SHA1
  
  019f6890fe89eb79d117a827ea08e5e69d0e8dac
- SHA256
  
  52ee340152fd8b2aed4497ce08434c437d8b1fb455751897f192577f35545353
- SHA512
  
  373d4155a1e0e3e6b14e45104a456546d5aefba63fbaa2d4a16a258831983db18ed1b7ceac3543911391a00a276f3abd5f22b304086085d7860e2f2ffebe0c7b
- SSDEEP
  
  768:wl+RxOpPNN0nhpOA3JfHYBjgPI9di6N4xmhQhIUV5VekqgerEZH4sSnKeGzE:wl/NOx4BOCHBmeUVBerEZ/S/UE
Score

10^/10

evasion persistence privilege_escalation trojan
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Modifies Windows Firewall
  evasion
- Deletes itself
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalationtrojan

behavioral2

evasionpersistenceprivilege_escalationtrojan