fc6e43ca905bd6605cd20ff59aca8fe77ed24cdf67143d9ab022d87a6d150eb4 | Triage

Sharing

General

Target

edabdd8768b933026a5a6d8354c0ff55_JaffaCakes118
Size

23.0MB
Sample

240920-qkf4ksydrl
MD5

edabdd8768b933026a5a6d8354c0ff55
SHA1

bf988e0707fc8053a5e3ca2b706a222ad6c0a47e
SHA256

fc6e43ca905bd6605cd20ff59aca8fe77ed24cdf67143d9ab022d87a6d150eb4
SHA512

520c001993bc753ccbb1452550bd5ee56e921117e7b5079c7f02ae9f17dad93e56555e041f24272b561dbaf064f126896bb663b9898925f12f614c6172e6cd0d
SSDEEP

12288:Ev3928bIXttL0fRJpo5+pT1EXOoM+9S3fL1+u:E12VXTipo5+pT1gOksvL1+

Score

10^/10

discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  edabdd8768b933026a5a6d8354c0ff55_JaffaCakes118
- Size
  
  23.0MB
- MD5
  
  edabdd8768b933026a5a6d8354c0ff55
- SHA1
  
  bf988e0707fc8053a5e3ca2b706a222ad6c0a47e
- SHA256
  
  fc6e43ca905bd6605cd20ff59aca8fe77ed24cdf67143d9ab022d87a6d150eb4
- SHA512
  
  520c001993bc753ccbb1452550bd5ee56e921117e7b5079c7f02ae9f17dad93e56555e041f24272b561dbaf064f126896bb663b9898925f12f614c6172e6cd0d
- SSDEEP
  
  12288:Ev3928bIXttL0fRJpo5+pT1EXOoM+9S3fL1+u:E12VXTipo5+pT1gOksvL1+
Score

10^/10

discovery evasion persistence trojan
- UAC bypass
  evasion trojan
- Disables Task Manager via registry modification
  evasion
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencetrojan

behavioral2

discoveryevasionpersistencetrojan