724333d57a79efd6b56ef0451206d4c04c90f6ed85e363bfd26c43d7f2ff5124 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b294e18e7cba198d748cdcee578d59de_JaffaCakes118
Size

79KB
Sample

240821-h8rafszdnk
MD5

b294e18e7cba198d748cdcee578d59de
SHA1

48fa0d21c63150e6dc80b99812c0bc7ec9606d62
SHA256

724333d57a79efd6b56ef0451206d4c04c90f6ed85e363bfd26c43d7f2ff5124
SHA512

bd3f88fc8446d879fe97970722e8602ed87be29f9b50805d4cd393c4ac1b92b1811a4d8471f9b3fe56726801b1d11081e99e0f09dba6d583f5d86dadbd633383
SSDEEP

1536:5WFro3Zoa+O9lmUPpk6iN5z0OvmiwJfrhl:5Wg4PN5FYr

Score

8^/10

discovery evasion execution persistence

Malware Config

Targets

- Target
  
  b294e18e7cba198d748cdcee578d59de_JaffaCakes118
- Size
  
  79KB
- MD5
  
  b294e18e7cba198d748cdcee578d59de
- SHA1
  
  48fa0d21c63150e6dc80b99812c0bc7ec9606d62
- SHA256
  
  724333d57a79efd6b56ef0451206d4c04c90f6ed85e363bfd26c43d7f2ff5124
- SHA512
  
  bd3f88fc8446d879fe97970722e8602ed87be29f9b50805d4cd393c4ac1b92b1811a4d8471f9b3fe56726801b1d11081e99e0f09dba6d583f5d86dadbd633383
- SSDEEP
  
  1536:5WFro3Zoa+O9lmUPpk6iN5z0OvmiwJfrhl:5Wg4PN5FYr
Score

8^/10

discovery evasion execution persistence
- Stops running service(s)
  evasion execution
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

discoveryevasionexecutionpersistence

behavioral2

discoveryevasionexecutionpersistence