471661dc09dfc572273906c2414730b9efefdb611b3c6869eacffad5f23591c0 | Triage

Sharing

General

Target

ed7d328ed76995a62501bf068ecd6286_JaffaCakes118
Size

408KB
Sample

240920-nms5tavajn
MD5

ed7d328ed76995a62501bf068ecd6286
SHA1

a4066344e4f47c6a405d14ce98850e49f710a8f0
SHA256

471661dc09dfc572273906c2414730b9efefdb611b3c6869eacffad5f23591c0
SHA512

73f921df50d58b6cc25f902ee2230543c8338eb604e88806de888ffca926f89928c20ad821823220547ebcf6b48ce69520ad730b89c895d0a5a2911ca45e820a
SSDEEP

12288:3hmjgh6pQscHg+yeTYkxLLVfsZvTmROE:EUHg+wsfsBmZ

Score

10^/10

discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  ed7d328ed76995a62501bf068ecd6286_JaffaCakes118
- Size
  
  408KB
- MD5
  
  ed7d328ed76995a62501bf068ecd6286
- SHA1
  
  a4066344e4f47c6a405d14ce98850e49f710a8f0
- SHA256
  
  471661dc09dfc572273906c2414730b9efefdb611b3c6869eacffad5f23591c0
- SHA512
  
  73f921df50d58b6cc25f902ee2230543c8338eb604e88806de888ffca926f89928c20ad821823220547ebcf6b48ce69520ad730b89c895d0a5a2911ca45e820a
- SSDEEP
  
  12288:3hmjgh6pQscHg+yeTYkxLLVfsZvTmROE:EUHg+wsfsBmZ
Score

10^/10

discovery evasion persistence trojan
- Windows security bypass
  evasion trojan
- Disables taskbar notifications via registry modification
  evasion
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencetrojan

behavioral2