cbef5b50135bf050e95104d347d797c1c4f753f5ebd6560dabb5c74c062e69f4 | Triage

Sharing

General

Target

f5b84aac8231f90691e0e941b082b73a_JaffaCakes118
Size

679KB
Sample

240925-llw4za1elc
MD5

f5b84aac8231f90691e0e941b082b73a
SHA1

7b5fcae3e70bccb11d21374b8aaf5d992b928c57
SHA256

cbef5b50135bf050e95104d347d797c1c4f753f5ebd6560dabb5c74c062e69f4
SHA512

313d268e57e74f7fb321edfe30d754f902162df21b2e3ebb9421c09391c8b1915e78542deb82c9eaa15cf139b9d2e1ce2fbb104340409b7d55277a7b77acc724
SSDEEP

12288:Xfv10mDYPkraLRmue9sBB0ENb0+3N69htjVz7ZSSzlnoh42GQr5eFQ:PM8RPY0+d6NNtHzloSb80K

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  f5b84aac8231f90691e0e941b082b73a_JaffaCakes118
- Size
  
  679KB
- MD5
  
  f5b84aac8231f90691e0e941b082b73a
- SHA1
  
  7b5fcae3e70bccb11d21374b8aaf5d992b928c57
- SHA256
  
  cbef5b50135bf050e95104d347d797c1c4f753f5ebd6560dabb5c74c062e69f4
- SHA512
  
  313d268e57e74f7fb321edfe30d754f902162df21b2e3ebb9421c09391c8b1915e78542deb82c9eaa15cf139b9d2e1ce2fbb104340409b7d55277a7b77acc724
- SSDEEP
  
  12288:Xfv10mDYPkraLRmue9sBB0ENb0+3N69htjVz7ZSSzlnoh42GQr5eFQ:PM8RPY0+d6NNtHzloSb80K
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Scripting

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence