902b14e0890f1662bbd607b2b5de513b7437f651ecc15ba0f1752a2dad29a68f | Triage

Sharing

General

Target

a8325a3c24b751222f1088941a080d22_JaffaCakes118
Size

452KB
Sample

240818-zvn2lsxcqm
MD5

a8325a3c24b751222f1088941a080d22
SHA1

97c67ee95ee680f84687433ec5d9c21ff2df9f10
SHA256

902b14e0890f1662bbd607b2b5de513b7437f651ecc15ba0f1752a2dad29a68f
SHA512

6842cc2606c808c2effe10067e14e0f7e97aced436e3087e05fd0c47308a7c3162446613445cff8d8b9a561b1dc31672fcf0a8b2fc1e9a1c43e3e373ef362076
SSDEEP

6144:KMJAx/t9srfk2m9sl9fevykltEIBOaIlw2MEHvUnbR8sgKQzwAkIFLqo5:KXt9gfk2asl9gcs2Mku8sgRpkIRqo

Score

10^/10

discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  a8325a3c24b751222f1088941a080d22_JaffaCakes118
- Size
  
  452KB
- MD5
  
  a8325a3c24b751222f1088941a080d22
- SHA1
  
  97c67ee95ee680f84687433ec5d9c21ff2df9f10
- SHA256
  
  902b14e0890f1662bbd607b2b5de513b7437f651ecc15ba0f1752a2dad29a68f
- SHA512
  
  6842cc2606c808c2effe10067e14e0f7e97aced436e3087e05fd0c47308a7c3162446613445cff8d8b9a561b1dc31672fcf0a8b2fc1e9a1c43e3e373ef362076
- SSDEEP
  
  6144:KMJAx/t9srfk2m9sl9fevykltEIBOaIlw2MEHvUnbR8sgKQzwAkIFLqo5:KXt9gfk2asl9gcs2Mku8sgRpkIRqo
Score

10^/10

discovery evasion persistence trojan
- Windows security bypass
  evasion trojan
- Disables taskbar notifications via registry modification
  evasion
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencetrojan

behavioral2