9e5ecfff411ab51682f4f355612147d06cdc7af9d8e097ffd412da5f829be3df | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118
Size

524KB
Sample

240905-264bsatgne
MD5

ce209eb70c3a7c6869c1ca0970dbf9e3
SHA1

310fac586facc9a880cda9bbb12b932a33ba4e45
SHA256

9e5ecfff411ab51682f4f355612147d06cdc7af9d8e097ffd412da5f829be3df
SHA512

09bb76d190b23185b579089d9a60dacd65176b83e93c56a207673096dbdd0ce65e74628b694f1d12d9136cf144d1309945e0fb98729357d1096ab1bbb0218f8c
SSDEEP

6144:uNEp9SELCwdo2hUfjeXN4rjWswCzgZmXELkIcKEynZnD0JaAbCQ8BmHIo1TI9wil:CJ2hd9HCILIKZYnemtYNxHKHDNNQ

Score

10^/10

discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  ce209eb70c3a7c6869c1ca0970dbf9e3_JaffaCakes118
- Size
  
  524KB
- MD5
  
  ce209eb70c3a7c6869c1ca0970dbf9e3
- SHA1
  
  310fac586facc9a880cda9bbb12b932a33ba4e45
- SHA256
  
  9e5ecfff411ab51682f4f355612147d06cdc7af9d8e097ffd412da5f829be3df
- SHA512
  
  09bb76d190b23185b579089d9a60dacd65176b83e93c56a207673096dbdd0ce65e74628b694f1d12d9136cf144d1309945e0fb98729357d1096ab1bbb0218f8c
- SSDEEP
  
  6144:uNEp9SELCwdo2hUfjeXN4rjWswCzgZmXELkIcKEynZnD0JaAbCQ8BmHIo1TI9wil:CJ2hd9HCILIKZYnemtYNxHKHDNNQ
Score

10^/10

discovery evasion persistence trojan
- Modifies firewall policy service
  evasion
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencetrojan

behavioral2

discoveryevasionpersistencetrojan