c678d739ff373b5be062a61c67722445248cfa6e1305345fe76d261582b3b3e6 | Triage

Sharing

General

Target

babe22ad20b1d81dbea6dd5a3ad0a956_JaffaCakes118
Size

77KB
Sample

240823-hqg9tssgpr
MD5

babe22ad20b1d81dbea6dd5a3ad0a956
SHA1

f89294d486a72175264dd03bfbacfe868d1dc755
SHA256

c678d739ff373b5be062a61c67722445248cfa6e1305345fe76d261582b3b3e6
SHA512

e97a30875dc8008a3d5ce668b824ed5126f4b8d432f2ec4c21da6ff1c5a150961ac441741d07268c5e6f9fc5e230ddb9ec9410da71555901c0bf426351ea4930
SSDEEP

1536:hi5thCmxaOntowmNIg0mQGLGYyHWAC/xZOp4PbhLyqGYcB/WnA+DFb6:hEtR8tL9/PZZBLNQ+DR6

Score

10^/10

discovery evasion trojan

Malware Config

Targets

- Target
  
  babe22ad20b1d81dbea6dd5a3ad0a956_JaffaCakes118
- Size
  
  77KB
- MD5
  
  babe22ad20b1d81dbea6dd5a3ad0a956
- SHA1
  
  f89294d486a72175264dd03bfbacfe868d1dc755
- SHA256
  
  c678d739ff373b5be062a61c67722445248cfa6e1305345fe76d261582b3b3e6
- SHA512
  
  e97a30875dc8008a3d5ce668b824ed5126f4b8d432f2ec4c21da6ff1c5a150961ac441741d07268c5e6f9fc5e230ddb9ec9410da71555901c0bf426351ea4930
- SSDEEP
  
  1536:hi5thCmxaOntowmNIg0mQGLGYyHWAC/xZOp4PbhLyqGYcB/WnA+DFb6:hEtR8tL9/PZZBLNQ+DR6
Score

10^/10

discovery evasion trojan
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Looks for VMWare Tools registry key
  evasion
- Deletes itself
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasiontrojan

behavioral2

discoveryevasiontrojan