b861254b1e2c18385e511778d2c94253cb77e9136cc7beefb931a638047301a3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

681a7a85a0379be470fd02351ea4c6ea_JaffaCakes118
Size

388KB
Sample

240723-sn8n4szaqd
MD5

681a7a85a0379be470fd02351ea4c6ea
SHA1

4cbe8e1bce516a3463492a08e8d58236bdb8a09c
SHA256

b861254b1e2c18385e511778d2c94253cb77e9136cc7beefb931a638047301a3
SHA512

99e4926f8546b0c3e8e27b71e54a16f6a1ac9c74261d7f9c9b591a7c78806304e6700816011887a85fb5e482d6d119f8239a4e30ffe4eccb11040fee9dbcd61a
SSDEEP

6144:Jq/+ep82m8Anc7amzdxyQEf5d+vheNaENwg6DutB4aeqq/SDrdmmklBnsz+uY:Jz6MAamJxof5EheN9wg6NaeqUS0pmzo

Score

8^/10

discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  681a7a85a0379be470fd02351ea4c6ea_JaffaCakes118
- Size
  
  388KB
- MD5
  
  681a7a85a0379be470fd02351ea4c6ea
- SHA1
  
  4cbe8e1bce516a3463492a08e8d58236bdb8a09c
- SHA256
  
  b861254b1e2c18385e511778d2c94253cb77e9136cc7beefb931a638047301a3
- SHA512
  
  99e4926f8546b0c3e8e27b71e54a16f6a1ac9c74261d7f9c9b591a7c78806304e6700816011887a85fb5e482d6d119f8239a4e30ffe4eccb11040fee9dbcd61a
- SSDEEP
  
  6144:Jq/+ep82m8Anc7amzdxyQEf5d+vheNaENwg6DutB4aeqq/SDrdmmklBnsz+uY:Jz6MAamJxof5EheN9wg6NaeqUS0pmzo
Score

8^/10

discovery evasion persistence trojan
- Downloads MZ/PE file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencetrojan

behavioral2

discoveryevasionpersistencetrojan