b8ac4309b319dae0fced99da3a92eb5f4e3bc93a948edd4937bb5f526fb8774f | Triage

Sharing

General

Target

af10deae5b6f71130260467d877a4661_JaffaCakes118
Size

149KB
Sample

240820-nrne5azama
MD5

af10deae5b6f71130260467d877a4661
SHA1

0935a1a1ad83f1bb49197b992ed6b03e3b3de39a
SHA256

b8ac4309b319dae0fced99da3a92eb5f4e3bc93a948edd4937bb5f526fb8774f
SHA512

8a657381926888371d29151b5d9a59a1f93fde9c3a5e705ea2bde0f8104146c23100fc516ab35affdf26db43966714d8cde1b2752a390d55378343ea7be256e4
SSDEEP

3072:eDMEsdcg9+xQgxbDVigBV1mkQcW6qXS7wtO9cGxexelQlPM:e+NkxQPgXUclqXS8A9cG8JM

Score

8^/10

defense_evasion discovery persistence privilege_escalation vmprotect

Malware Config

Targets

- Target
  
  af10deae5b6f71130260467d877a4661_JaffaCakes118
- Size
  
  149KB
- MD5
  
  af10deae5b6f71130260467d877a4661
- SHA1
  
  0935a1a1ad83f1bb49197b992ed6b03e3b3de39a
- SHA256
  
  b8ac4309b319dae0fced99da3a92eb5f4e3bc93a948edd4937bb5f526fb8774f
- SHA512
  
  8a657381926888371d29151b5d9a59a1f93fde9c3a5e705ea2bde0f8104146c23100fc516ab35affdf26db43966714d8cde1b2752a390d55378343ea7be256e4
- SSDEEP
  
  3072:eDMEsdcg9+xQgxbDVigBV1mkQcW6qXS7wtO9cGxexelQlPM:e+NkxQPgXUclqXS8A9cG8JM
Score

8^/10

defense_evasion discovery persistence privilege_escalation vmprotect
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Deletes itself
- Loads dropped DLL
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Adds Run key to start application
  persistence
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

AppInit DLLs

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

AppInit DLLs

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoverypersistenceprivilege_escalationvmprotect

behavioral2

defense_evasiondiscoverypersistenceprivilege_escalationvmprotect