88e00b938d16ebd5e7a875962edcb0c04bb83b8dd0fa24423c40011864d599d5 | Triage

Sharing

General

Target

ed49262cd09fcfe7f816c46b9a8df953_JaffaCakes118
Size

524KB
Sample

240920-lafylsygmh
MD5

ed49262cd09fcfe7f816c46b9a8df953
SHA1

ddf6f692e1fe9c06cd057e74500b1b00849e7c7d
SHA256

88e00b938d16ebd5e7a875962edcb0c04bb83b8dd0fa24423c40011864d599d5
SHA512

85460de0fcc6d2fb594e8b3df3e924e7037556dfffa67c0a563c523d2057e07a9e7cf451e0a0a1bf403025f1177e216299535f1d1c1d45a35f59ea54b8bec254
SSDEEP

12288:hfN8ggkDEOXvNeNRBKn51Vh6T3y7fmvB7lO0FU4d:FN8ggkDtSQz6Tz202

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  ed49262cd09fcfe7f816c46b9a8df953_JaffaCakes118
- Size
  
  524KB
- MD5
  
  ed49262cd09fcfe7f816c46b9a8df953
- SHA1
  
  ddf6f692e1fe9c06cd057e74500b1b00849e7c7d
- SHA256
  
  88e00b938d16ebd5e7a875962edcb0c04bb83b8dd0fa24423c40011864d599d5
- SHA512
  
  85460de0fcc6d2fb594e8b3df3e924e7037556dfffa67c0a563c523d2057e07a9e7cf451e0a0a1bf403025f1177e216299535f1d1c1d45a35f59ea54b8bec254
- SSDEEP
  
  12288:hfN8ggkDEOXvNeNRBKn51Vh6T3y7fmvB7lO0FU4d:FN8ggkDtSQz6Tz202
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Adds policy Run key to start application
  persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence