c97d5d6092b8a44c88317b5d0f578eefa0c10858487ed1062502213d4bb82079 | Triage

Sharing

General

Target

b8c1b1ef0d7e7ba0b49a3e2468e701fe_JaffaCakes118
Size

456KB
Sample

240822-xlx7taseka
MD5

b8c1b1ef0d7e7ba0b49a3e2468e701fe
SHA1

bec532c58a9b29d4944b9ee1a9b1f79c79536eca
SHA256

c97d5d6092b8a44c88317b5d0f578eefa0c10858487ed1062502213d4bb82079
SHA512

f02e062d0cf11a2d9b0f7037d645427415d6fde14324f421d7e886f4e6950cd62d0c7645b0585d1ddc93f88e619442c73c6c1b89e3c3716609ec7d9220cd51fb
SSDEEP

12288:pFvSSNOT9q3zY+Kwj1IBj0xRrVZpp9X6:ujT9qjPB+Bj0RbK

Score

10^/10

discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  b8c1b1ef0d7e7ba0b49a3e2468e701fe_JaffaCakes118
- Size
  
  456KB
- MD5
  
  b8c1b1ef0d7e7ba0b49a3e2468e701fe
- SHA1
  
  bec532c58a9b29d4944b9ee1a9b1f79c79536eca
- SHA256
  
  c97d5d6092b8a44c88317b5d0f578eefa0c10858487ed1062502213d4bb82079
- SHA512
  
  f02e062d0cf11a2d9b0f7037d645427415d6fde14324f421d7e886f4e6950cd62d0c7645b0585d1ddc93f88e619442c73c6c1b89e3c3716609ec7d9220cd51fb
- SSDEEP
  
  12288:pFvSSNOT9q3zY+Kwj1IBj0xRrVZpp9X6:ujT9qjPB+Bj0RbK
Score

10^/10

discovery evasion persistence trojan
- Windows security bypass
  evasion trojan
- Disables taskbar notifications via registry modification
  evasion
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencetrojan

behavioral2