536277b88cc12f7ceba1b706209cbd49ad8ac4bb6530c20c5afbb2f116ff9750 | Triage

Sharing

General

Target

ece4b7bfe469bf0f30029bcbcf9bb520_JaffaCakes118
Size

472KB
Sample

240920-fqlk5szhmp
MD5

ece4b7bfe469bf0f30029bcbcf9bb520
SHA1

adf241afb85aa339a4037e4d1645042a810c5e8e
SHA256

536277b88cc12f7ceba1b706209cbd49ad8ac4bb6530c20c5afbb2f116ff9750
SHA512

7274c260558a194d63b70e23d6464bcf9b852207f66a09da4d3551131f70cc6414a335080e556e4ccb986f3bdd7ffbeae4e6e702a7c752c209d603b18f16248e
SSDEEP

6144:mPhmDTfL0IPDnlI1iTNndjjRrJlybvOIEbuUkblgqp5kAUk/:aqTQIblmsHRrJlyb2IEbubbvnUk/

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  ece4b7bfe469bf0f30029bcbcf9bb520_JaffaCakes118
- Size
  
  472KB
- MD5
  
  ece4b7bfe469bf0f30029bcbcf9bb520
- SHA1
  
  adf241afb85aa339a4037e4d1645042a810c5e8e
- SHA256
  
  536277b88cc12f7ceba1b706209cbd49ad8ac4bb6530c20c5afbb2f116ff9750
- SHA512
  
  7274c260558a194d63b70e23d6464bcf9b852207f66a09da4d3551131f70cc6414a335080e556e4ccb986f3bdd7ffbeae4e6e702a7c752c209d603b18f16248e
- SSDEEP
  
  6144:mPhmDTfL0IPDnlI1iTNndjjRrJlybvOIEbuUkblgqp5kAUk/:aqTQIblmsHRrJlyb2IEbubbvnUk/
Score

10^/10

discovery evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence