a96ae1dd912fc866007706b3f4f94491fb11397de5bf2a917da1412d00abf3c0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

71c6c18a7143cd13e7c785f8631b8e17_JaffaCakes118
Size

420KB
Sample

240725-3yb31atakp
MD5

71c6c18a7143cd13e7c785f8631b8e17
SHA1

a7934c73b0d2bebc2479e7bb42309863b4a0b80f
SHA256

a96ae1dd912fc866007706b3f4f94491fb11397de5bf2a917da1412d00abf3c0
SHA512

0f0c9757aae8819c45f1321ab9a7f197c56a787407ac2b6928ed8bde585eb2639ed5ce4ad94799a2a1bb633bf1c9bbaa97302703c23d628891d7c22323012d06
SSDEEP

12288:zwNoQNPKmi5sfUU51pXaFMj1zl/lMxo/lo7CcZGe:cHNPKqfd/lRNcZ3

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  71c6c18a7143cd13e7c785f8631b8e17_JaffaCakes118
- Size
  
  420KB
- MD5
  
  71c6c18a7143cd13e7c785f8631b8e17
- SHA1
  
  a7934c73b0d2bebc2479e7bb42309863b4a0b80f
- SHA256
  
  a96ae1dd912fc866007706b3f4f94491fb11397de5bf2a917da1412d00abf3c0
- SHA512
  
  0f0c9757aae8819c45f1321ab9a7f197c56a787407ac2b6928ed8bde585eb2639ed5ce4ad94799a2a1bb633bf1c9bbaa97302703c23d628891d7c22323012d06
- SSDEEP
  
  12288:zwNoQNPKmi5sfUU51pXaFMj1zl/lMxo/lo7CcZGe:cHNPKqfd/lRNcZ3
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence