db0978d9183766c6022103fa30a7f8abe91178fcacd4ee3ab91bead45cb3e09a | Triage

Sharing

General

Target

f0c6d1494e2460798907b8eda46ecab6_JaffaCakes118
Size

96KB
Sample

240921-2vybdsyema
MD5

f0c6d1494e2460798907b8eda46ecab6
SHA1

681fc890ce873036851349c2282a94a3b7d3ecd9
SHA256

db0978d9183766c6022103fa30a7f8abe91178fcacd4ee3ab91bead45cb3e09a
SHA512

bbca4307905533c8df90acd3aadeed1e852d88622c60c80df6c41ff57014a84d86bdf1f27d6d8f6746198502bbcd7168734b5c495b986d6755120ba424f32edc
SSDEEP

1536:GR1+aJe1mgawzxsBub8PC1jIHxATVGG2HWqTgDRGJHl7cYPePiNaCjIHxATVG9+4:GR1+aJe1mgawzxsBub861jIHxowD2qT+

Score

8^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  f0c6d1494e2460798907b8eda46ecab6_JaffaCakes118
- Size
  
  96KB
- MD5
  
  f0c6d1494e2460798907b8eda46ecab6
- SHA1
  
  681fc890ce873036851349c2282a94a3b7d3ecd9
- SHA256
  
  db0978d9183766c6022103fa30a7f8abe91178fcacd4ee3ab91bead45cb3e09a
- SHA512
  
  bbca4307905533c8df90acd3aadeed1e852d88622c60c80df6c41ff57014a84d86bdf1f27d6d8f6746198502bbcd7168734b5c495b986d6755120ba424f32edc
- SSDEEP
  
  1536:GR1+aJe1mgawzxsBub8PC1jIHxATVGG2HWqTgDRGJHl7cYPePiNaCjIHxATVG9+4:GR1+aJe1mgawzxsBub861jIHxowD2qT+
Score

8^/10

discovery evasion persistence
- Disables Task Manager via registry modification
  evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Adds Run key to start application
  persistence
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence