45bcd92b0c26df9bfea22aab8f14f444b48a7a6d7d8252ac2ea84709f629a714 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6fd774837cfad861c8049c33018ccf2e_JaffaCakes118
Size

1.6MB
Sample

240725-q5zfnavdpa
MD5

6fd774837cfad861c8049c33018ccf2e
SHA1

e70fa90d79fd9e3e9e7d62bee8d94369315369d4
SHA256

45bcd92b0c26df9bfea22aab8f14f444b48a7a6d7d8252ac2ea84709f629a714
SHA512

8c99f1e6ae6d5e77db6b03bb885cdc2f5dee4b94bbfaa856617bbb32709cbe7fe4dc8d8366f28a451f0a5aa39576a3be677c69c519773f4217f08c734bcd3d18
SSDEEP

49152:SlIyYuF37I8Re/Nh01OtaLzE5lSgDRaLJH5plyT5plyd5ply:SBrde/Nh01OkE5zg5plyT5plyd5ply

Score

8^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  6fd774837cfad861c8049c33018ccf2e_JaffaCakes118
- Size
  
  1.6MB
- MD5
  
  6fd774837cfad861c8049c33018ccf2e
- SHA1
  
  e70fa90d79fd9e3e9e7d62bee8d94369315369d4
- SHA256
  
  45bcd92b0c26df9bfea22aab8f14f444b48a7a6d7d8252ac2ea84709f629a714
- SHA512
  
  8c99f1e6ae6d5e77db6b03bb885cdc2f5dee4b94bbfaa856617bbb32709cbe7fe4dc8d8366f28a451f0a5aa39576a3be677c69c519773f4217f08c734bcd3d18
- SSDEEP
  
  49152:SlIyYuF37I8Re/Nh01OtaLzE5lSgDRaLJH5plyT5plyd5ply:SBrde/Nh01OkE5zg5plyT5plyd5ply
Score

8^/10

discovery evasion persistence
- Disables Task Manager via registry modification
  evasion
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence