da42e23b31e12488592e4b531359b87d797d260cd17490b49ff90aad6a052a2e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f4fe39d38065aa78947e5eae06158c9c_JaffaCakes118
Size

648KB
Sample

240925-c6aa9stbmg
MD5

f4fe39d38065aa78947e5eae06158c9c
SHA1

3d9128a4167a3b11820be30430cc467ae8e7db0c
SHA256

da42e23b31e12488592e4b531359b87d797d260cd17490b49ff90aad6a052a2e
SHA512

5e6b9b62c62b76c9d68987d281ff47e8843617a047a2aeed3c5702d49abb919e1f5ced736fa0a947f5b77092030de7d02ef4fa79c52031f253f6c68324b0ba65
SSDEEP

12288:KiHaJtaX0WBgQNNCAXk+aiptW5v9edN1gFAbdYF:KiHAw9An+qI+

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  f4fe39d38065aa78947e5eae06158c9c_JaffaCakes118
- Size
  
  648KB
- MD5
  
  f4fe39d38065aa78947e5eae06158c9c
- SHA1
  
  3d9128a4167a3b11820be30430cc467ae8e7db0c
- SHA256
  
  da42e23b31e12488592e4b531359b87d797d260cd17490b49ff90aad6a052a2e
- SHA512
  
  5e6b9b62c62b76c9d68987d281ff47e8843617a047a2aeed3c5702d49abb919e1f5ced736fa0a947f5b77092030de7d02ef4fa79c52031f253f6c68324b0ba65
- SSDEEP
  
  12288:KiHaJtaX0WBgQNNCAXk+aiptW5v9edN1gFAbdYF:KiHAw9An+qI+
Score

10^/10

discovery evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence