9b658af3ee466fd01fdf2ab53a0eaebec48c52c30a1d3c2ea5190457de8c99a5 | Triage

Sharing

General

Target

d13c20ddcd9a0ddaa15811b8a4bdba47_JaffaCakes118
Size

26KB
Sample

240907-gqz9zaybll
MD5

d13c20ddcd9a0ddaa15811b8a4bdba47
SHA1

ef52b79dffd3abe9e16799f10ea65cb79311612a
SHA256

9b658af3ee466fd01fdf2ab53a0eaebec48c52c30a1d3c2ea5190457de8c99a5
SHA512

509945f8f46bf41d1f7a1e528782b1c88811b90accaf25da8734e64ae4e7647d57f87b93d69544c7e127d5e86ec0a06465aa340a329e6e342cf0b42e7221d1bb
SSDEEP

384:m1dLdCYsFeeJSDvzalGUSuVTqvErH+gY5Ah63JtnX0V5gFnYndJlXaA7vr:mnQYsFzJMvcGUStEreVAE5lX0gnYdr

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  d13c20ddcd9a0ddaa15811b8a4bdba47_JaffaCakes118
- Size
  
  26KB
- MD5
  
  d13c20ddcd9a0ddaa15811b8a4bdba47
- SHA1
  
  ef52b79dffd3abe9e16799f10ea65cb79311612a
- SHA256
  
  9b658af3ee466fd01fdf2ab53a0eaebec48c52c30a1d3c2ea5190457de8c99a5
- SHA512
  
  509945f8f46bf41d1f7a1e528782b1c88811b90accaf25da8734e64ae4e7647d57f87b93d69544c7e127d5e86ec0a06465aa340a329e6e342cf0b42e7221d1bb
- SSDEEP
  
  384:m1dLdCYsFeeJSDvzalGUSuVTqvErH+gY5Ah63JtnX0V5gFnYndJlXaA7vr:mnQYsFzJMvcGUStEreVAE5lX0gnYdr
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence