ed6b39fcb1ae870df3f60aa2de8ea3809a364c5b57a13c662973442f4929af57 | Triage

Sharing

General

Target

a1a44be3c34145e13bdd062e4782697e_JaffaCakes118
Size

276KB
Sample

240817-h48c6sxapm
MD5

a1a44be3c34145e13bdd062e4782697e
SHA1

0f5b1321d8572864e898ea8b285f21691c42f7e0
SHA256

ed6b39fcb1ae870df3f60aa2de8ea3809a364c5b57a13c662973442f4929af57
SHA512

096e6c28aadc85cb38826aa9425fa23309210e5433d408f2ab5297b5f59752737a0c9affd1143dde624a188ccdeca69f7581ba53bf43b489c81c51e0bf0ddc67
SSDEEP

3072:xX0e1FB/DpKjCLHhgEBJxb8dlLtw4pEqz:7bqlL2i

Score

10^/10

discovery evasion trojan

Malware Config

Targets

- Target
  
  a1a44be3c34145e13bdd062e4782697e_JaffaCakes118
- Size
  
  276KB
- MD5
  
  a1a44be3c34145e13bdd062e4782697e
- SHA1
  
  0f5b1321d8572864e898ea8b285f21691c42f7e0
- SHA256
  
  ed6b39fcb1ae870df3f60aa2de8ea3809a364c5b57a13c662973442f4929af57
- SHA512
  
  096e6c28aadc85cb38826aa9425fa23309210e5433d408f2ab5297b5f59752737a0c9affd1143dde624a188ccdeca69f7581ba53bf43b489c81c51e0bf0ddc67
- SSDEEP
  
  3072:xX0e1FB/DpKjCLHhgEBJxb8dlLtw4pEqz:7bqlL2i
Score

10^/10

discovery evasion trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasiontrojan

behavioral2

discoveryevasiontrojan