75c70e1cfce580c7af9083b9a214785d13d54f3e50f6a963e9a2ef64071318ce | Triage

Sharing

General

Target

ce38420a8eb127e33ff0b71f2730af53_JaffaCakes118
Size

773KB
Sample

240906-ag75wswajj
MD5

ce38420a8eb127e33ff0b71f2730af53
SHA1

421d264594c2674efaadda6c80c7bec894243293
SHA256

75c70e1cfce580c7af9083b9a214785d13d54f3e50f6a963e9a2ef64071318ce
SHA512

ee02822089d80bec613e987821ad876865eb997bac560bba39dd9f92e81f4106969c6c5631af9784e4391dd9001f7577ff1155b2a2d08418125f401f5f3556a4
SSDEEP

12288:5Lo3AFptjgbGiAFptjgbGXeb3E2TImvOmbNtW4JWHOyUDO6nw9Er/N3tjXbli3ir:Dj37j3ODkm2mhtGO5IEr/N3/A

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  ce38420a8eb127e33ff0b71f2730af53_JaffaCakes118
- Size
  
  773KB
- MD5
  
  ce38420a8eb127e33ff0b71f2730af53
- SHA1
  
  421d264594c2674efaadda6c80c7bec894243293
- SHA256
  
  75c70e1cfce580c7af9083b9a214785d13d54f3e50f6a963e9a2ef64071318ce
- SHA512
  
  ee02822089d80bec613e987821ad876865eb997bac560bba39dd9f92e81f4106969c6c5631af9784e4391dd9001f7577ff1155b2a2d08418125f401f5f3556a4
- SSDEEP
  
  12288:5Lo3AFptjgbGiAFptjgbGXeb3E2TImvOmbNtW4JWHOyUDO6nw9Er/N3tjXbli3ir:Dj37j3ODkm2mhtGO5IEr/N3/A
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoverypersistence