5da8828eadc74138f6f8966823852c08de6742dcf3178b416c0e2744d1cfd258 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d04af31a903bee3b84882edc05e3399f_JaffaCakes118
Size

40KB
Sample

240906-x3mseatepj
MD5

d04af31a903bee3b84882edc05e3399f
SHA1

23d59ac608d1ebbe6902cf081be1e46067713e3c
SHA256

5da8828eadc74138f6f8966823852c08de6742dcf3178b416c0e2744d1cfd258
SHA512

e4fdec329ffa917415d78be35bba7ff96f209abb16b53b338afbbee58ff6d8f14476c082606b8b2c81aaf8b5cf6d7863d6cab29d14266db77125d11a7ee5cecf
SSDEEP

768:bu3kR8HC/ZVodmUaaKJGm+CPE8q1p8swi8ax9W+J/WjoEt9vDx0m0OdXvO3jXvLI:C0Rb/TpAOGm7Xou08Ix/ZavDdDE3jXjI

Score

10^/10

defense_evasion discovery evasion persistence privilege_escalation trojan upx

Malware Config

Targets

- Target
  
  d04af31a903bee3b84882edc05e3399f_JaffaCakes118
- Size
  
  40KB
- MD5
  
  d04af31a903bee3b84882edc05e3399f
- SHA1
  
  23d59ac608d1ebbe6902cf081be1e46067713e3c
- SHA256
  
  5da8828eadc74138f6f8966823852c08de6742dcf3178b416c0e2744d1cfd258
- SHA512
  
  e4fdec329ffa917415d78be35bba7ff96f209abb16b53b338afbbee58ff6d8f14476c082606b8b2c81aaf8b5cf6d7863d6cab29d14266db77125d11a7ee5cecf
- SSDEEP
  
  768:bu3kR8HC/ZVodmUaaKJGm+CPE8q1p8swi8ax9W+J/WjoEt9vDx0m0OdXvO3jXvLI:C0Rb/TpAOGm7Xou08Ix/ZavDdDE3jXjI
Score

10^/10

defense_evasion discovery evasion persistence privilege_escalation trojan upx
- UAC bypass
  evasion trojan
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Deletes itself
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks whether UAC is enabled
  evasion trojan
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

AppInit DLLs

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Event Triggered Execution

AppInit DLLs

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojanupx

behavioral2

defense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojanupx