b134af6f260a2925e22d0f3f97d7cb8dd59e8f63e1cc95f73bf1f5c98e507438 | Triage

Sharing

General

Target

8ba740eec0c2d10940e2689074634ab2_JaffaCakes118
Size

648KB
Sample

240811-x28cqatfjl
MD5

8ba740eec0c2d10940e2689074634ab2
SHA1

dbdcb942efc8bd3655189b58481da161bf94ea3f
SHA256

b134af6f260a2925e22d0f3f97d7cb8dd59e8f63e1cc95f73bf1f5c98e507438
SHA512

372a494fda1bfc3fd48a176195a69d6e0779407b93c25b7ebe8479d46fb9e4d825c2dac39b12d983e20a9eac7b8c8fcdd6082c6e189c554abd8f8148190bfa43
SSDEEP

12288:7iHaJtaX0WBgQNNlAXk+aiptW5v9edN1gFAbdYQl:7iHAw9zn+qI+Ql

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  8ba740eec0c2d10940e2689074634ab2_JaffaCakes118
- Size
  
  648KB
- MD5
  
  8ba740eec0c2d10940e2689074634ab2
- SHA1
  
  dbdcb942efc8bd3655189b58481da161bf94ea3f
- SHA256
  
  b134af6f260a2925e22d0f3f97d7cb8dd59e8f63e1cc95f73bf1f5c98e507438
- SHA512
  
  372a494fda1bfc3fd48a176195a69d6e0779407b93c25b7ebe8479d46fb9e4d825c2dac39b12d983e20a9eac7b8c8fcdd6082c6e189c554abd8f8148190bfa43
- SSDEEP
  
  12288:7iHaJtaX0WBgQNNlAXk+aiptW5v9edN1gFAbdYQl:7iHAw9zn+qI+Ql
Score

10^/10

discovery evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence