c9e3660748e54241156bc6d17c90663e77ff18ec0d38d6267530e40d7492df9f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

af142c1da1d14692b8f18e232c0e19da_JaffaCakes118
Size

392KB
Sample

240820-nt141azbna
MD5

af142c1da1d14692b8f18e232c0e19da
SHA1

73cc39f93efe1a5ee274b2fcaad9c91fe015abfe
SHA256

c9e3660748e54241156bc6d17c90663e77ff18ec0d38d6267530e40d7492df9f
SHA512

4bf0f3371669e41287300017b6eb78922a4a79e63bd5f171069ddcbd87f78442404145296a938dd650a2ac439d18d76d1fe54fde15cc5a707dde8b77e7d00ff9
SSDEEP

6144:jgzBkIaCB8wFYjMFwLQNOhsI4LC5JB2pIsgFA4iRCrvPCi3apgbuAAcOLdhzRKE/:j15JuIs69ioLPCnpgbzOphL9N

Score

7^/10

discovery persistence upx

Malware Config

Targets

- Target
  
  af142c1da1d14692b8f18e232c0e19da_JaffaCakes118
- Size
  
  392KB
- MD5
  
  af142c1da1d14692b8f18e232c0e19da
- SHA1
  
  73cc39f93efe1a5ee274b2fcaad9c91fe015abfe
- SHA256
  
  c9e3660748e54241156bc6d17c90663e77ff18ec0d38d6267530e40d7492df9f
- SHA512
  
  4bf0f3371669e41287300017b6eb78922a4a79e63bd5f171069ddcbd87f78442404145296a938dd650a2ac439d18d76d1fe54fde15cc5a707dde8b77e7d00ff9
- SSDEEP
  
  6144:jgzBkIaCB8wFYjMFwLQNOhsI4LC5JB2pIsgFA4iRCrvPCi3apgbuAAcOLdhzRKE/:j15JuIs69ioLPCnpgbzOphL9N
Score

7^/10

discovery persistence upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Software Discovery

Security Software Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistenceupx

behavioral2