f84392a6ec9d2451c71475d7d257a0baa3df0613f7c2a8eb5721c5aea4df4c3b | Triage

Sharing

General

Target

d6bdbd633799083892ae333a5d16f5b7_JaffaCakes118
Size

176KB
Sample

240909-vge5bsyhrj
MD5

d6bdbd633799083892ae333a5d16f5b7
SHA1

89ac52b58a6b6cd1d5844833318c27d53a3212fc
SHA256

f84392a6ec9d2451c71475d7d257a0baa3df0613f7c2a8eb5721c5aea4df4c3b
SHA512

ed17906049a910a1e40df36164848a04e79cf51c5f1efeea139e5393d810d752572f54a9a3c1379c258f2fe7f911388622a20a0f46cf0fdd421f81ae594562f8
SSDEEP

3072:wP13b4ooAAA6c9RJoaZoV9456s6jNIzsn1dpTOYYiR6:wPdb4MhwaA1TrYi

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  d6bdbd633799083892ae333a5d16f5b7_JaffaCakes118
- Size
  
  176KB
- MD5
  
  d6bdbd633799083892ae333a5d16f5b7
- SHA1
  
  89ac52b58a6b6cd1d5844833318c27d53a3212fc
- SHA256
  
  f84392a6ec9d2451c71475d7d257a0baa3df0613f7c2a8eb5721c5aea4df4c3b
- SHA512
  
  ed17906049a910a1e40df36164848a04e79cf51c5f1efeea139e5393d810d752572f54a9a3c1379c258f2fe7f911388622a20a0f46cf0fdd421f81ae594562f8
- SSDEEP
  
  3072:wP13b4ooAAA6c9RJoaZoV9456s6jNIzsn1dpTOYYiR6:wPdb4MhwaA1TrYi
Score

8^/10

discovery persistence
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence