a5ca2c1e6a6f62e6c3dcbcb4c914b925ce34c79624a6cf4e479c4d4eca6454a5 | Triage

Sharing

General

Target

f9bc9b4d60ed2eef60d1a7fc10582a5d_JaffaCakes118
Size

185KB
Sample

240927-fez96ayflc
MD5

f9bc9b4d60ed2eef60d1a7fc10582a5d
SHA1

611bffa12cb371fa8489550bb231ec495a61fdbd
SHA256

a5ca2c1e6a6f62e6c3dcbcb4c914b925ce34c79624a6cf4e479c4d4eca6454a5
SHA512

8cbb1c31e6ab28ef8e39fee696a2ef1e104bd8947886733ae2c04aa3f2d3d12dfe4901c3f7cebe8850e3fea8dd919255b1a7c83b140ed61f1692c0ccd9227ca9
SSDEEP

3072:pXGwTy8LYhC4bFrJCPW/Vfx3XgcVA3aMek3+2t9O9:pWQy4vorzVfx3ides+26

Score

10^/10

discovery evasion trojan

Malware Config

Targets

- Target
  
  f9bc9b4d60ed2eef60d1a7fc10582a5d_JaffaCakes118
- Size
  
  185KB
- MD5
  
  f9bc9b4d60ed2eef60d1a7fc10582a5d
- SHA1
  
  611bffa12cb371fa8489550bb231ec495a61fdbd
- SHA256
  
  a5ca2c1e6a6f62e6c3dcbcb4c914b925ce34c79624a6cf4e479c4d4eca6454a5
- SHA512
  
  8cbb1c31e6ab28ef8e39fee696a2ef1e104bd8947886733ae2c04aa3f2d3d12dfe4901c3f7cebe8850e3fea8dd919255b1a7c83b140ed61f1692c0ccd9227ca9
- SSDEEP
  
  3072:pXGwTy8LYhC4bFrJCPW/Vfx3XgcVA3aMek3+2t9O9:pWQy4vorzVfx3ides+26
Score

10^/10

discovery evasion trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasiontrojan

behavioral2

discoveryevasiontrojan