a4bd8c6432c3d669352f1dc790909c8251cc510dfce9bd00c5c2526efd1def7b | Triage

Sharing

General

Target

b46e9a8d67872aca77156c64657f7dd1_JaffaCakes118
Size

299KB
Sample

240821-weqcysscmg
MD5

b46e9a8d67872aca77156c64657f7dd1
SHA1

3d7e1d70923c2e8194ff2cc9d1a29c80fe36c1fd
SHA256

a4bd8c6432c3d669352f1dc790909c8251cc510dfce9bd00c5c2526efd1def7b
SHA512

5f57ed3bd81154517755f91b3663fc39a10cc00a1f402b42d7b90b310c9279cc4982499b628ef2470f9c15e2aa72fc215f133423f1e7baf69e5cec52a29d5a32
SSDEEP

6144:wQsFXitOhWmu6ZXiuBc9TfwytgBQmGdzzowiljarLxChwTkS:WXUGiuBQIAUL43owCeJIwTP

Score

8^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  b46e9a8d67872aca77156c64657f7dd1_JaffaCakes118
- Size
  
  299KB
- MD5
  
  b46e9a8d67872aca77156c64657f7dd1
- SHA1
  
  3d7e1d70923c2e8194ff2cc9d1a29c80fe36c1fd
- SHA256
  
  a4bd8c6432c3d669352f1dc790909c8251cc510dfce9bd00c5c2526efd1def7b
- SHA512
  
  5f57ed3bd81154517755f91b3663fc39a10cc00a1f402b42d7b90b310c9279cc4982499b628ef2470f9c15e2aa72fc215f133423f1e7baf69e5cec52a29d5a32
- SSDEEP
  
  6144:wQsFXitOhWmu6ZXiuBc9TfwytgBQmGdzzowiljarLxChwTkS:WXUGiuBQIAUL43owCeJIwTP
Score

8^/10

discovery evasion persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables taskbar notifications via registry modification
  evasion
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2