f25952a9652b2aa565c769a640318b2bc485a13862d8b94b02495d4c37bb2193 | Triage

Sharing

General

Target

eef438334b116b3bc32126a46ab72767_JaffaCakes118
Size

166KB
Sample

240921-dkb4easclp
MD5

eef438334b116b3bc32126a46ab72767
SHA1

320b9d27183cb32a55bd7efe6ddc62c12d202297
SHA256

f25952a9652b2aa565c769a640318b2bc485a13862d8b94b02495d4c37bb2193
SHA512

066915d8b5d4e14a72f641d737e7354e31464690ef42de12f1c6fa2e6242ccf60411e4b68ac7c831ddcbe510912611c3220fe9a190a7fb4b4f26d36297211757
SSDEEP

3072:U1wojz1hwuXvEf6BYFaN50ziYa9KYcu6nl4eKiLcLcal46+Afa:U2ojzcuXsf6BYAYziYa9b6nlpKA+4Rc

Score

10^/10

discovery evasion

Malware Config

Targets

- Target
  
  eef438334b116b3bc32126a46ab72767_JaffaCakes118
- Size
  
  166KB
- MD5
  
  eef438334b116b3bc32126a46ab72767
- SHA1
  
  320b9d27183cb32a55bd7efe6ddc62c12d202297
- SHA256
  
  f25952a9652b2aa565c769a640318b2bc485a13862d8b94b02495d4c37bb2193
- SHA512
  
  066915d8b5d4e14a72f641d737e7354e31464690ef42de12f1c6fa2e6242ccf60411e4b68ac7c831ddcbe510912611c3220fe9a190a7fb4b4f26d36297211757
- SSDEEP
  
  3072:U1wojz1hwuXvEf6BYFaN50ziYa9KYcu6nl4eKiLcLcal46+Afa:U2ojzcuXsf6BYAYziYa9b6nlpKA+4Rc
Score

10^/10

discovery evasion
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Deletes itself
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasion

behavioral2