591de44bfd6401d955e21d0866d5a8d4c55719957b5c67b61bbd7e091029e6f0 | Triage

Sharing

General

Target

838cb0e9a5558f0347982e473d60bde8_JaffaCakes118
Size

632KB
Sample

240809-zvy7ksshjf
MD5

838cb0e9a5558f0347982e473d60bde8
SHA1

b14525236d2641ee9aa0bc21f022bf7f0291cccb
SHA256

591de44bfd6401d955e21d0866d5a8d4c55719957b5c67b61bbd7e091029e6f0
SHA512

a8087b19d2bb7bced1b33c72676dbac1127e3b55b57cd93ff9082daecb75b6ffe72259795ea0c5718119d09174ef444195354dcd94cb627db47dc79591edebc3
SSDEEP

12288:kQZedl6DAKebwz6Nmf3u989turmzmq6GU7BHMGrdEaz4YQ4DEdQFmjKh:SrbFk/+8HzK73z4d5

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  838cb0e9a5558f0347982e473d60bde8_JaffaCakes118
- Size
  
  632KB
- MD5
  
  838cb0e9a5558f0347982e473d60bde8
- SHA1
  
  b14525236d2641ee9aa0bc21f022bf7f0291cccb
- SHA256
  
  591de44bfd6401d955e21d0866d5a8d4c55719957b5c67b61bbd7e091029e6f0
- SHA512
  
  a8087b19d2bb7bced1b33c72676dbac1127e3b55b57cd93ff9082daecb75b6ffe72259795ea0c5718119d09174ef444195354dcd94cb627db47dc79591edebc3
- SSDEEP
  
  12288:kQZedl6DAKebwz6Nmf3u989turmzmq6GU7BHMGrdEaz4YQ4DEdQFmjKh:SrbFk/+8HzK73z4d5
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Scripting

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence