8729cfe97b80703f531d6274f128b4a027ab08903b0ef6bc41c64c45e05e7df7 | Triage

Sharing

General

Target

eab38f8ff58dc7df9f27d067754670d7_JaffaCakes118
Size

636KB
Sample

240919-gjk7gatgjl
MD5

eab38f8ff58dc7df9f27d067754670d7
SHA1

4f13c5e746c3b76c233b450ba4c2e5babe041260
SHA256

8729cfe97b80703f531d6274f128b4a027ab08903b0ef6bc41c64c45e05e7df7
SHA512

b589f6bbd2ea339650aff6c05dfa3b7264fa0335f818863af0e2df93b17c198d358c4e6115afcc23b8b34b9fb8d7a760480e6510b618ea4c62f2538539f65266
SSDEEP

12288:woZB7TepbosaV5jTuQzA6VPSrAtQwbafJOMIXlpZVv7GCckZWu+KfsX36j96:woZo7i5uQz9VPEfwbuJOMI19vqChZW3w

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  eab38f8ff58dc7df9f27d067754670d7_JaffaCakes118
- Size
  
  636KB
- MD5
  
  eab38f8ff58dc7df9f27d067754670d7
- SHA1
  
  4f13c5e746c3b76c233b450ba4c2e5babe041260
- SHA256
  
  8729cfe97b80703f531d6274f128b4a027ab08903b0ef6bc41c64c45e05e7df7
- SHA512
  
  b589f6bbd2ea339650aff6c05dfa3b7264fa0335f818863af0e2df93b17c198d358c4e6115afcc23b8b34b9fb8d7a760480e6510b618ea4c62f2538539f65266
- SSDEEP
  
  12288:woZB7TepbosaV5jTuQzA6VPSrAtQwbafJOMIXlpZVv7GCckZWu+KfsX36j96:woZo7i5uQz9VPEfwbuJOMI19vqChZW3w
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Scripting

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoveryevasionpersistence