1113e6b478fbda0ab341f0f3fc45a9181180d84b16a87441c44004fac17f09bd | Triage

Sharing

General

Target

eec52647e08ee86e35245ede01dc1ec6_JaffaCakes118
Size

696KB
Sample

240921-ba8nhsxdrh
MD5

eec52647e08ee86e35245ede01dc1ec6
SHA1

4d00ec6abf7811b4663bde070977ec3a03a65a09
SHA256

1113e6b478fbda0ab341f0f3fc45a9181180d84b16a87441c44004fac17f09bd
SHA512

3429f27ceed9297ec1325e151a57b7cd234be04325b53c070b2d9e860d5ce06667feb9416cb3e6dd4c56d79b8b4ceed52bbbef73204aa40e903d10ea6328c2db
SSDEEP

12288:Upv2JeImtATsST5sNZAHcxhTTfqejoWBE167dD83Q7XirheRsUxkEZ0V:U92gIiS5gZA8j/qioWWQV8g7E9E6V

Score

10^/10

discovery evasion execution exploit persistence trojan

Malware Config

Targets

- Target
  
  eec52647e08ee86e35245ede01dc1ec6_JaffaCakes118
- Size
  
  696KB
- MD5
  
  eec52647e08ee86e35245ede01dc1ec6
- SHA1
  
  4d00ec6abf7811b4663bde070977ec3a03a65a09
- SHA256
  
  1113e6b478fbda0ab341f0f3fc45a9181180d84b16a87441c44004fac17f09bd
- SHA512
  
  3429f27ceed9297ec1325e151a57b7cd234be04325b53c070b2d9e860d5ce06667feb9416cb3e6dd4c56d79b8b4ceed52bbbef73204aa40e903d10ea6328c2db
- SSDEEP
  
  12288:Upv2JeImtATsST5sNZAHcxhTTfqejoWBE167dD83Q7XirheRsUxkEZ0V:U92gIiS5gZA8j/qioWWQV8g7E9E6V
Score

10^/10

discovery evasion execution exploit persistence trojan
- Disables service(s)
  evasion execution
- Windows security bypass
  evasion trojan
- Possible privilege escalation attempt
  exploit
- Executes dropped EXE
- Modifies file permissions
  discovery
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

File and Directory Permissions Modification

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

behavioral2

discoveryevasionexecutionexploitpersistencetrojan