40e799b8c94dcb862bb2c274a3b6447b377ace041f7dab8eb46352e23d4034d5 | Triage

Sharing

General

Target

ed2340efcacb2c12ebbd52c82c6c4260_JaffaCakes118
Size

230KB
Sample

240920-jntqhswemn
MD5

ed2340efcacb2c12ebbd52c82c6c4260
SHA1

ee84f29c36b2868556889cf1ddd8f3dbba4b4114
SHA256

40e799b8c94dcb862bb2c274a3b6447b377ace041f7dab8eb46352e23d4034d5
SHA512

3b68eee609e2cdf6b30245d1cf491ce5eb47f949a23c7bfb1fa9a5616f222d95026b0e23854395ee3f2fbfeeb3f31945d367550ea06180fb4ba5fcaf4db4ad9e
SSDEEP

6144:N/CW3e0dZfFgCZTdsmnEllI+R2xfVRUiu7wu64H:N91dTdxGmnOlufjBHv4H

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  ed2340efcacb2c12ebbd52c82c6c4260_JaffaCakes118
- Size
  
  230KB
- MD5
  
  ed2340efcacb2c12ebbd52c82c6c4260
- SHA1
  
  ee84f29c36b2868556889cf1ddd8f3dbba4b4114
- SHA256
  
  40e799b8c94dcb862bb2c274a3b6447b377ace041f7dab8eb46352e23d4034d5
- SHA512
  
  3b68eee609e2cdf6b30245d1cf491ce5eb47f949a23c7bfb1fa9a5616f222d95026b0e23854395ee3f2fbfeeb3f31945d367550ea06180fb4ba5fcaf4db4ad9e
- SSDEEP
  
  6144:N/CW3e0dZfFgCZTdsmnEllI+R2xfVRUiu7wu64H:N91dTdxGmnOlufjBHv4H
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence