e358361b18b88755e205216901af3a5275776f98ad78006f62708b193970f68f | Triage

Sharing

General

Target

c7cd0d4b5aae097c99033d7657036f99_JaffaCakes118
Size

376KB
Sample

240828-2xkhbasfpr
MD5

c7cd0d4b5aae097c99033d7657036f99
SHA1

4eb6921aa918b141eb07b681dc14e8b5cbcd0fdd
SHA256

e358361b18b88755e205216901af3a5275776f98ad78006f62708b193970f68f
SHA512

379b299b90cf98eba6e3bb00ea01a49fb460a522d86bed990a8c76fca32b3804f35361657dae103374a1b5f16e0a6a0de155ad8f3b2ebaf50600efb09a49e885
SSDEEP

6144:SJem9dmbu7WrnVQl+UtgJRQJ91B7AtL6DLS4nau9h6G0xUEzDTXDhzmC/:SJejK7Wrn5g1B7W6y4aa6G0fDzD

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  c7cd0d4b5aae097c99033d7657036f99_JaffaCakes118
- Size
  
  376KB
- MD5
  
  c7cd0d4b5aae097c99033d7657036f99
- SHA1
  
  4eb6921aa918b141eb07b681dc14e8b5cbcd0fdd
- SHA256
  
  e358361b18b88755e205216901af3a5275776f98ad78006f62708b193970f68f
- SHA512
  
  379b299b90cf98eba6e3bb00ea01a49fb460a522d86bed990a8c76fca32b3804f35361657dae103374a1b5f16e0a6a0de155ad8f3b2ebaf50600efb09a49e885
- SSDEEP
  
  6144:SJem9dmbu7WrnVQl+UtgJRQJ91B7AtL6DLS4nau9h6G0xUEzDTXDhzmC/:SJejK7Wrn5g1B7W6y4aa6G0fDzD
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence