2fd9b8ddf2102cbec9fc80def48713a6d3c7b73b978bef2f45c82805aa420cc0 | Triage

Sharing

General

Target

ed7f53415d1c897b05ec4c69d33fe09f_JaffaCakes118
Size

167KB
Sample

240920-nq9xqsvbnr
MD5

ed7f53415d1c897b05ec4c69d33fe09f
SHA1

12403b386b2ad94d60e2a194b6720697eb88c16d
SHA256

2fd9b8ddf2102cbec9fc80def48713a6d3c7b73b978bef2f45c82805aa420cc0
SHA512

0a78204ff4189b979fd90efb35aa78500c0a3ed14d4c7674ae98612646f04c2c1c0ff7ebcfe6034e71cde37fadc3ec101fc3771fba60e8fcca397c78aed87a54
SSDEEP

3072:col1+7paqQdzZJmjzwJYkJu5ePh4Xs3TmBMOy2kKcRFN4qn8IWpnDMlZ:co75qaJrJtkePys3qBMOy2KFy48+

Score

10^/10

discovery evasion

Malware Config

Targets

- Target
  
  ed7f53415d1c897b05ec4c69d33fe09f_JaffaCakes118
- Size
  
  167KB
- MD5
  
  ed7f53415d1c897b05ec4c69d33fe09f
- SHA1
  
  12403b386b2ad94d60e2a194b6720697eb88c16d
- SHA256
  
  2fd9b8ddf2102cbec9fc80def48713a6d3c7b73b978bef2f45c82805aa420cc0
- SHA512
  
  0a78204ff4189b979fd90efb35aa78500c0a3ed14d4c7674ae98612646f04c2c1c0ff7ebcfe6034e71cde37fadc3ec101fc3771fba60e8fcca397c78aed87a54
- SSDEEP
  
  3072:col1+7paqQdzZJmjzwJYkJu5ePh4Xs3TmBMOy2kKcRFN4qn8IWpnDMlZ:co75qaJrJtkePys3qBMOy2KFy48+
Score

10^/10

discovery evasion
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Deletes itself
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasion

behavioral2