db92191c433bdf2239701e3da5acfc912918be22f9aa7aa7e45c1ec191d19553 | Triage

Sharing

General

Target

b0ab8dade5f5354bf9b7c674a4d88881_JaffaCakes118
Size

392KB
Sample

240820-yz2mtsvenj
MD5

b0ab8dade5f5354bf9b7c674a4d88881
SHA1

7bfefd9b16bf718acf75072f474dcb7c27a6a0e9
SHA256

db92191c433bdf2239701e3da5acfc912918be22f9aa7aa7e45c1ec191d19553
SHA512

308b528b43b8058f82a48b0daa5ae9e9227c13c859a2087c2e8de8b4a82f6659ff1a749349365acf5f4967826575dc04c72adb9a4fba5c808b669e636a55d499
SSDEEP

6144:gMxW2mGp9VUwTZtX02giP9YoRRQGb8gJCPankzjzVjyTVyS9m1D4dxYd:gwfjmwTZSihRQwJCi4zVWThBrYd

Score

10^/10

discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  b0ab8dade5f5354bf9b7c674a4d88881_JaffaCakes118
- Size
  
  392KB
- MD5
  
  b0ab8dade5f5354bf9b7c674a4d88881
- SHA1
  
  7bfefd9b16bf718acf75072f474dcb7c27a6a0e9
- SHA256
  
  db92191c433bdf2239701e3da5acfc912918be22f9aa7aa7e45c1ec191d19553
- SHA512
  
  308b528b43b8058f82a48b0daa5ae9e9227c13c859a2087c2e8de8b4a82f6659ff1a749349365acf5f4967826575dc04c72adb9a4fba5c808b669e636a55d499
- SSDEEP
  
  6144:gMxW2mGp9VUwTZtX02giP9YoRRQGb8gJCPankzjzVjyTVyS9m1D4dxYd:gwfjmwTZSihRQwJCi4zVWThBrYd
Score

10^/10

discovery evasion persistence trojan
- Windows security bypass
  evasion trojan
- Disables taskbar notifications via registry modification
  evasion
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencetrojan

behavioral2