fd4dea59ed40ec256b74c5eaf9f4225dce2b5748b28ff3735642c841d2fc5619 | Triage

Sharing

General

Target

9694c58f605a5ba69806c27a56df07f0_JaffaCakes118
Size

72KB
Sample

240814-se2jfatdjj
MD5

9694c58f605a5ba69806c27a56df07f0
SHA1

c10bfcf737966b18f5d98202e662848ccbe6b8cc
SHA256

fd4dea59ed40ec256b74c5eaf9f4225dce2b5748b28ff3735642c841d2fc5619
SHA512

a7a71355ca9e950c03248e8fdd16c0d1f59f66af1a2245e13994b95f0b1898f40f7b2d85f45ec148c662eb070b8cc35f91f4ed45caa9f933fc94891dffa09923
SSDEEP

384:kdccNLu5/ShfsLdccNLu5/ShfsGJDolEJZpHAvWm1OukV:kdJNa5LdJNa5moCLpgvWmXkV

Score

8^/10

defense_evasion discovery persistence

Malware Config

Targets

- Target
  
  9694c58f605a5ba69806c27a56df07f0_JaffaCakes118
- Size
  
  72KB
- MD5
  
  9694c58f605a5ba69806c27a56df07f0
- SHA1
  
  c10bfcf737966b18f5d98202e662848ccbe6b8cc
- SHA256
  
  fd4dea59ed40ec256b74c5eaf9f4225dce2b5748b28ff3735642c841d2fc5619
- SHA512
  
  a7a71355ca9e950c03248e8fdd16c0d1f59f66af1a2245e13994b95f0b1898f40f7b2d85f45ec148c662eb070b8cc35f91f4ed45caa9f933fc94891dffa09923
- SSDEEP
  
  384:kdccNLu5/ShfsLdccNLu5/ShfsGJDolEJZpHAvWm1OukV:kdJNa5LdJNa5moCLpgvWmXkV
Score

8^/10

defense_evasion discovery persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoverypersistence

behavioral2

defense_evasiondiscoverypersistence