7e71dd62eb9da404c271e460e71ffb36782998bb035d0189a8f532d018673040 | Triage

Sharing

General

Target

7181fdf93b081a5d9c949c8177c61cbe_JaffaCakes118
Size

799KB
Sample

240725-2gcgrssbne
MD5

7181fdf93b081a5d9c949c8177c61cbe
SHA1

a2fd90689ec55fc78ceea6e3689a56418ab914af
SHA256

7e71dd62eb9da404c271e460e71ffb36782998bb035d0189a8f532d018673040
SHA512

b627fdff07384dd530ae2e7b9cf99fbc2138fb26b340c4b72f2620cc1201ac46ecbe15798c28d03c0423fa668803d5f13cc161949fd2eb1f6c498bd3c852d683
SSDEEP

24576:J2+Lh6oBlWwrI9d9EQ5n/BRwtBRHDMVZp:DhTEj9zZRwtyn

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  7181fdf93b081a5d9c949c8177c61cbe_JaffaCakes118
- Size
  
  799KB
- MD5
  
  7181fdf93b081a5d9c949c8177c61cbe
- SHA1
  
  a2fd90689ec55fc78ceea6e3689a56418ab914af
- SHA256
  
  7e71dd62eb9da404c271e460e71ffb36782998bb035d0189a8f532d018673040
- SHA512
  
  b627fdff07384dd530ae2e7b9cf99fbc2138fb26b340c4b72f2620cc1201ac46ecbe15798c28d03c0423fa668803d5f13cc161949fd2eb1f6c498bd3c852d683
- SSDEEP
  
  24576:J2+Lh6oBlWwrI9d9EQ5n/BRwtBRHDMVZp:DhTEj9zZRwtyn
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence