2b2c3d8011e5c7549c40c6abf5408b3b442c4f23b1b4980af5fa6e4954336d0f | Triage

Sharing

General

Target

ee686d188951d86882f11841f32978d4_JaffaCakes118
Size

360KB
Sample

240920-zq9graxgmr
MD5

ee686d188951d86882f11841f32978d4
SHA1

941d5ef67a478929d9e91689e90b00d587c068cf
SHA256

2b2c3d8011e5c7549c40c6abf5408b3b442c4f23b1b4980af5fa6e4954336d0f
SHA512

4c7a35dd495523e2d2f035f0c58c8ec4ea5be2eab76b54bcdc26d501fa7c8925e5169c6096c056a95f5c86ec34be0f3c8bb862a410d5c34baf6c3c8522c21fce
SSDEEP

6144:5gVHy4A1P2VtDBaSbKIN6VNAkVPxrXBEsyC4MgJkEfevZut:+ly4AStDwCVNWNA8PtXBzjxa

Score

10^/10

discovery evasion trojan

Malware Config

Targets

- Target
  
  ee686d188951d86882f11841f32978d4_JaffaCakes118
- Size
  
  360KB
- MD5
  
  ee686d188951d86882f11841f32978d4
- SHA1
  
  941d5ef67a478929d9e91689e90b00d587c068cf
- SHA256
  
  2b2c3d8011e5c7549c40c6abf5408b3b442c4f23b1b4980af5fa6e4954336d0f
- SHA512
  
  4c7a35dd495523e2d2f035f0c58c8ec4ea5be2eab76b54bcdc26d501fa7c8925e5169c6096c056a95f5c86ec34be0f3c8bb862a410d5c34baf6c3c8522c21fce
- SSDEEP
  
  6144:5gVHy4A1P2VtDBaSbKIN6VNAkVPxrXBEsyC4MgJkEfevZut:+ly4AStDwCVNWNA8PtXBzjxa
Score

10^/10

discovery evasion trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Disables taskbar notifications via registry modification
  evasion
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasiontrojan

behavioral2