1c6c929bda49b3a6438019697ab62fed6657997af5faaa351cd1ad8197ac88ba | Triage

Sharing

General

Target

ac2e6c3ab45d7ec9e42f1a234fe70917_JaffaCakes118
Size

676KB
Sample

240819-xl8zbavall
MD5

ac2e6c3ab45d7ec9e42f1a234fe70917
SHA1

ac5ea6e5716df8d77622a7e1e6a716672fdf2542
SHA256

1c6c929bda49b3a6438019697ab62fed6657997af5faaa351cd1ad8197ac88ba
SHA512

98366dfe672555855354f37c87a441f6a396874743b3902b743c49fe9eaa0e424daac232c188992938c0cc770f3380f70b3e47f336cbfe1fd2106cc5ca45d185
SSDEEP

12288:u94Vcog9PElU7QpmQWBteo44a05rOTWXOGhJuq1YjvFXbhkBHRc3aVDLUVi:XNlJcFRMq2jv8BHBgo

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  ac2e6c3ab45d7ec9e42f1a234fe70917_JaffaCakes118
- Size
  
  676KB
- MD5
  
  ac2e6c3ab45d7ec9e42f1a234fe70917
- SHA1
  
  ac5ea6e5716df8d77622a7e1e6a716672fdf2542
- SHA256
  
  1c6c929bda49b3a6438019697ab62fed6657997af5faaa351cd1ad8197ac88ba
- SHA512
  
  98366dfe672555855354f37c87a441f6a396874743b3902b743c49fe9eaa0e424daac232c188992938c0cc770f3380f70b3e47f336cbfe1fd2106cc5ca45d185
- SSDEEP
  
  12288:u94Vcog9PElU7QpmQWBteo44a05rOTWXOGhJuq1YjvFXbhkBHRc3aVDLUVi:XNlJcFRMq2jv8BHBgo
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Scripting

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence