8d38bc17b403978ee0f23589e14cba0015f7d85d2ce3f56703e9b038bf70889c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a8a26b1a03de78c2757058f9b6bc021a_JaffaCakes118
Size

517KB
Sample

240818-3bz7batejr
MD5

a8a26b1a03de78c2757058f9b6bc021a
SHA1

7a3d45696ee44eb50d555db51a7271b32c967979
SHA256

8d38bc17b403978ee0f23589e14cba0015f7d85d2ce3f56703e9b038bf70889c
SHA512

6f090923b781395ff2606098ff8b55b0d7a34f721d3ca9024ac466e8a4a15ac8e987c440dc2dda5f67cd1fa7c7faa53526d25333ac35738ea042dc895004c37e
SSDEEP

12288:nfJJCYDjB1xhAIQlULhrTokhanaSDK7Q7K:R4YZ1jLFHhEDyQ

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  a8a26b1a03de78c2757058f9b6bc021a_JaffaCakes118
- Size
  
  517KB
- MD5
  
  a8a26b1a03de78c2757058f9b6bc021a
- SHA1
  
  7a3d45696ee44eb50d555db51a7271b32c967979
- SHA256
  
  8d38bc17b403978ee0f23589e14cba0015f7d85d2ce3f56703e9b038bf70889c
- SHA512
  
  6f090923b781395ff2606098ff8b55b0d7a34f721d3ca9024ac466e8a4a15ac8e987c440dc2dda5f67cd1fa7c7faa53526d25333ac35738ea042dc895004c37e
- SSDEEP
  
  12288:nfJJCYDjB1xhAIQlULhrTokhanaSDK7Q7K:R4YZ1jLFHhEDyQ
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence