db036f98cae7b25337edbbe8ad4b3d1577cebaad074dcec07e6fcb1e6c91f7c8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a8fd70597bf318d9d47aa3bd451e86cd_JaffaCakes118
Size

946KB
Sample

240819-blnsgsygpn
MD5

a8fd70597bf318d9d47aa3bd451e86cd
SHA1

3342d83a2b48d18830c48a1ad205de0bdabf6aa3
SHA256

db036f98cae7b25337edbbe8ad4b3d1577cebaad074dcec07e6fcb1e6c91f7c8
SHA512

ff4460a8ccf2a8570823fcdf03459569eed3eae30a8c674378f78ed15c75aab4ff05688a07f743acc34221ab3885ce129c100d438d34ddc3e6a43d84b5c4eed7
SSDEEP

12288:rAASn37Gpae0Pzg+PJNBLu+dAkK5eCPn0w:qRPzZdBK5eyd

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  a8fd70597bf318d9d47aa3bd451e86cd_JaffaCakes118
- Size
  
  946KB
- MD5
  
  a8fd70597bf318d9d47aa3bd451e86cd
- SHA1
  
  3342d83a2b48d18830c48a1ad205de0bdabf6aa3
- SHA256
  
  db036f98cae7b25337edbbe8ad4b3d1577cebaad074dcec07e6fcb1e6c91f7c8
- SHA512
  
  ff4460a8ccf2a8570823fcdf03459569eed3eae30a8c674378f78ed15c75aab4ff05688a07f743acc34221ab3885ce129c100d438d34ddc3e6a43d84b5c4eed7
- SSDEEP
  
  12288:rAASn37Gpae0Pzg+PJNBLu+dAkK5eCPn0w:qRPzZdBK5eyd
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence