56e55b9bfeb685b21f6b50ec887a9f5892f4eb447defb85efc7ca4380549200e | Triage

Sharing

General

Target

eeb01fa0743d3b3a4349e1fb2a498acc_JaffaCakes118
Size

364KB
Sample

240920-3z38wavgme
MD5

eeb01fa0743d3b3a4349e1fb2a498acc
SHA1

2ff4536446d7d4b8c973b3d28b612217c3099538
SHA256

56e55b9bfeb685b21f6b50ec887a9f5892f4eb447defb85efc7ca4380549200e
SHA512

b79869caa921420d4f28200ab43e64f3dab85cd360ce8cb1aa3a6bfa637959ff88de420185280e58643f9236bcaa6c6829e34c570fc7816512a903aca0e55a1a
SSDEEP

6144:3Xc2XtsXWX7DEXs1yq/c1SWOXVGQSmPWwNWcCuqZXzXgTi13lLFNSFAhaQ5q:c2XtsXWXfu1yF3S5ZXzXgT0V8E

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  eeb01fa0743d3b3a4349e1fb2a498acc_JaffaCakes118
- Size
  
  364KB
- MD5
  
  eeb01fa0743d3b3a4349e1fb2a498acc
- SHA1
  
  2ff4536446d7d4b8c973b3d28b612217c3099538
- SHA256
  
  56e55b9bfeb685b21f6b50ec887a9f5892f4eb447defb85efc7ca4380549200e
- SHA512
  
  b79869caa921420d4f28200ab43e64f3dab85cd360ce8cb1aa3a6bfa637959ff88de420185280e58643f9236bcaa6c6829e34c570fc7816512a903aca0e55a1a
- SSDEEP
  
  6144:3Xc2XtsXWX7DEXs1yq/c1SWOXVGQSmPWwNWcCuqZXzXgTi13lLFNSFAhaQ5q:c2XtsXWXfu1yF3S5ZXzXgT0V8E
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoverypersistence