d81b77c97e07449962abea2cf2b939fd58baf0428310be72d8e7654722b4dcc2 | Triage

Sharing

General

Target

a4bdcefd97821332f39852f00b54a742_JaffaCakes118
Size

436KB
Sample

240818-a3d4yawdkb
MD5

a4bdcefd97821332f39852f00b54a742
SHA1

81018ef6ef0a11412b029524d865ae36ab6d3b91
SHA256

d81b77c97e07449962abea2cf2b939fd58baf0428310be72d8e7654722b4dcc2
SHA512

243e49ce01c56ee1a9eeb6824712044eb81f88a3dc199b408edb32b99534d5b45f29687586ac0ae2bec1acea9d0ac1fe2188d29227638f386e527cf49456fe73
SSDEEP

6144:BpPDCOkXvBftF2WKcxQIop4T6jjtmUIM9n8xrF50uZPpvEoFuK/w:fCVZftAZcxtT62bbDvEU

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  a4bdcefd97821332f39852f00b54a742_JaffaCakes118
- Size
  
  436KB
- MD5
  
  a4bdcefd97821332f39852f00b54a742
- SHA1
  
  81018ef6ef0a11412b029524d865ae36ab6d3b91
- SHA256
  
  d81b77c97e07449962abea2cf2b939fd58baf0428310be72d8e7654722b4dcc2
- SHA512
  
  243e49ce01c56ee1a9eeb6824712044eb81f88a3dc199b408edb32b99534d5b45f29687586ac0ae2bec1acea9d0ac1fe2188d29227638f386e527cf49456fe73
- SSDEEP
  
  6144:BpPDCOkXvBftF2WKcxQIop4T6jjtmUIM9n8xrF50uZPpvEoFuK/w:fCVZftAZcxtT62bbDvEU
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence