028a6bb745e4061070ef335938ce1e23ac62bde5f86c5229e4b1a013b83335c1 | Triage

Sharing

General

Target

b0dee0e12193893571bcc8c9aaca06ac_JaffaCakes118
Size

72KB
Sample

240820-z42dastejb
MD5

b0dee0e12193893571bcc8c9aaca06ac
SHA1

aebee2d7ce45678b1efc54aaa2576d5c76c4b5c6
SHA256

028a6bb745e4061070ef335938ce1e23ac62bde5f86c5229e4b1a013b83335c1
SHA512

03ca8d7168fd977df49597334b05b37534769c1ce96fba24c372f10521d26c62e4d6e564fa62ebbc247758e8ec316e09f11ff5390d3048e895a8569792cca1ae
SSDEEP

768:Goe1gWpJqddHs/FcNgwgN4Yle9JwVnHkN9/fq6WIu7bdVDM0MviCJ7swd5HR/CdF:fYcibNQdfq6Wz7bdVD9oF/bKwuA5uL

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  b0dee0e12193893571bcc8c9aaca06ac_JaffaCakes118
- Size
  
  72KB
- MD5
  
  b0dee0e12193893571bcc8c9aaca06ac
- SHA1
  
  aebee2d7ce45678b1efc54aaa2576d5c76c4b5c6
- SHA256
  
  028a6bb745e4061070ef335938ce1e23ac62bde5f86c5229e4b1a013b83335c1
- SHA512
  
  03ca8d7168fd977df49597334b05b37534769c1ce96fba24c372f10521d26c62e4d6e564fa62ebbc247758e8ec316e09f11ff5390d3048e895a8569792cca1ae
- SSDEEP
  
  768:Goe1gWpJqddHs/FcNgwgN4Yle9JwVnHkN9/fq6WIu7bdVDM0MviCJ7swd5HR/CdF:fYcibNQdfq6Wz7bdVD9oF/bKwuA5uL
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence