bf5544a581a28a9d087e1433942c5f7d795159e94b6bbd57e123d12ca9efef7c | Triage

Sharing

General

Target

ef31db485b286c40abef2665b9c1a367_JaffaCakes118
Size

136KB
Sample

240921-grwm6sxhng
MD5

ef31db485b286c40abef2665b9c1a367
SHA1

e827428f5605104003f3e2dd35f959b22946ae65
SHA256

bf5544a581a28a9d087e1433942c5f7d795159e94b6bbd57e123d12ca9efef7c
SHA512

ddd1c7205b8fddb59b50467df8ca1ca427a49df83bd5b86ba241e653c873ccf71edba437ae9dce476dedc1abe04412d07778315186982b236df57f0f015f40cd
SSDEEP

3072:KRauDEef20RIcdaDTdj1ShUxu22K87UdEPf66u/yMr:TuD/uh1Shaf277UO66uN

Score

10^/10

discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  ef31db485b286c40abef2665b9c1a367_JaffaCakes118
- Size
  
  136KB
- MD5
  
  ef31db485b286c40abef2665b9c1a367
- SHA1
  
  e827428f5605104003f3e2dd35f959b22946ae65
- SHA256
  
  bf5544a581a28a9d087e1433942c5f7d795159e94b6bbd57e123d12ca9efef7c
- SHA512
  
  ddd1c7205b8fddb59b50467df8ca1ca427a49df83bd5b86ba241e653c873ccf71edba437ae9dce476dedc1abe04412d07778315186982b236df57f0f015f40cd
- SSDEEP
  
  3072:KRauDEef20RIcdaDTdj1ShUxu22K87UdEPf66u/yMr:TuD/uh1Shaf277UO66uN
Score

10^/10

discovery evasion persistence trojan
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencetrojan

behavioral2

discoveryevasionpersistencetrojan