c400c01be9dfca5478a04415958935e3efa2f06b966a839fe2feb0e6823556f2 | Triage

Sharing

General

Target

781e5acc6895ae75925fde1313db6b75_JaffaCakes118
Size

434KB
Sample

240727-nzzs5a1ekb
MD5

781e5acc6895ae75925fde1313db6b75
SHA1

218e76a9856c39ff32ee03579c0d1c4e758cdf1f
SHA256

c400c01be9dfca5478a04415958935e3efa2f06b966a839fe2feb0e6823556f2
SHA512

867197ba572418b078885e03ea50cbf5b24fed8f877cd8c6170abdd676260eff1c2ba786464ae19cd0cc345a5515c79f4c73216a4a6a29eb65bab9966459f499
SSDEEP

6144:aPeFWaE1AOhqPCKTFfhg6MCvzkVWppjIFWljXdtHEgv1VBI/77EUGgK0StYW3Tet:aPey1maWp/MWYs7KgL7KjgUPajo

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  781e5acc6895ae75925fde1313db6b75_JaffaCakes118
- Size
  
  434KB
- MD5
  
  781e5acc6895ae75925fde1313db6b75
- SHA1
  
  218e76a9856c39ff32ee03579c0d1c4e758cdf1f
- SHA256
  
  c400c01be9dfca5478a04415958935e3efa2f06b966a839fe2feb0e6823556f2
- SHA512
  
  867197ba572418b078885e03ea50cbf5b24fed8f877cd8c6170abdd676260eff1c2ba786464ae19cd0cc345a5515c79f4c73216a4a6a29eb65bab9966459f499
- SSDEEP
  
  6144:aPeFWaE1AOhqPCKTFfhg6MCvzkVWppjIFWljXdtHEgv1VBI/77EUGgK0StYW3Tet:aPey1maWp/MWYs7KgL7KjgUPajo
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence