6904ef7f7268469f4e3a183eceaef429cb7d17ac0157aa72ccf33789ded2dc19 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8e2121c0a56cfd9547dd862b2d1394b9_JaffaCakes118
Size

392KB
Sample

240812-kzvmmatgnn
MD5

8e2121c0a56cfd9547dd862b2d1394b9
SHA1

adf30bb08bc23d5d6e882bd26b29a5c0fb130d0b
SHA256

6904ef7f7268469f4e3a183eceaef429cb7d17ac0157aa72ccf33789ded2dc19
SHA512

d8ffc0e073c089c17562c323c6b2a1d1e3e064d0e1476c25d1d73ac1247eaa29960754403901582e428a0920735df0c499aacdac6a9d79a00c90da2b9e5eaad0
SSDEEP

6144:Lb10YeUbXiDzvAwPVukXJMIj/1YTYK89XsbbuxZAN2y8QwgFRAE4wXk3P8C5i:X1nemiDMwxT6TYK0bs2yFw+RNRXk/P5i

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  8e2121c0a56cfd9547dd862b2d1394b9_JaffaCakes118
- Size
  
  392KB
- MD5
  
  8e2121c0a56cfd9547dd862b2d1394b9
- SHA1
  
  adf30bb08bc23d5d6e882bd26b29a5c0fb130d0b
- SHA256
  
  6904ef7f7268469f4e3a183eceaef429cb7d17ac0157aa72ccf33789ded2dc19
- SHA512
  
  d8ffc0e073c089c17562c323c6b2a1d1e3e064d0e1476c25d1d73ac1247eaa29960754403901582e428a0920735df0c499aacdac6a9d79a00c90da2b9e5eaad0
- SSDEEP
  
  6144:Lb10YeUbXiDzvAwPVukXJMIj/1YTYK89XsbbuxZAN2y8QwgFRAE4wXk3P8C5i:X1nemiDMwxT6TYK0bs2yFw+RNRXk/P5i
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence