16d3af97b94ff60c2638084cbb9f6891a062177bca45a6aeaada4ffbd52c6317 | Triage

Sharing

General

Target

d3aa522c547e69a19a56bc3baef0b55b_JaffaCakes118
Size

446KB
Sample

240908-gbjzfa1hne
MD5

d3aa522c547e69a19a56bc3baef0b55b
SHA1

5873c38158a62b05f9d801ca01f77bec950ab24d
SHA256

16d3af97b94ff60c2638084cbb9f6891a062177bca45a6aeaada4ffbd52c6317
SHA512

7784a867d5ce775536d9ed20b5317639764c5962eb3dc0d3a43aaa1e1e515904da521cb7ec500094536ab4dee614966676c43dedf37574d423ac7ddd0b144ec0
SSDEEP

6144:cbVEHTf9PCUGwqbDXVmjWEw8pvNissS0z7z0LYJCBqTiCvPyn8Vr/Akz:mI9JGVEfi17zogW78VF

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  d3aa522c547e69a19a56bc3baef0b55b_JaffaCakes118
- Size
  
  446KB
- MD5
  
  d3aa522c547e69a19a56bc3baef0b55b
- SHA1
  
  5873c38158a62b05f9d801ca01f77bec950ab24d
- SHA256
  
  16d3af97b94ff60c2638084cbb9f6891a062177bca45a6aeaada4ffbd52c6317
- SHA512
  
  7784a867d5ce775536d9ed20b5317639764c5962eb3dc0d3a43aaa1e1e515904da521cb7ec500094536ab4dee614966676c43dedf37574d423ac7ddd0b144ec0
- SSDEEP
  
  6144:cbVEHTf9PCUGwqbDXVmjWEw8pvNissS0z7z0LYJCBqTiCvPyn8Vr/Akz:mI9JGVEfi17zogW78VF
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Scripting

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence