39ec1bd1604c872851006d0439e6ae51e942a7d5d5f763f5c0c4524e8aee5646 | Triage

Sharing

General

Target

f9da07ad6475a8b0215f03c4507dd22c_JaffaCakes118
Size

448KB
Sample

240927-gqwa1sybpn
MD5

f9da07ad6475a8b0215f03c4507dd22c
SHA1

f166925a282b2b203d67df2e2691e2071dc7aacc
SHA256

39ec1bd1604c872851006d0439e6ae51e942a7d5d5f763f5c0c4524e8aee5646
SHA512

a62014783f09d4a525b439eea59543299fe18e123bd65abc680d35fe364d23fc8ce9f65529302693b331232ef604caa13ecd3c0b30ce9720d4a265e6c81ddd94
SSDEEP

12288:PBGpbBfAB8RvDB4N+nT74cWgr/x3jDqc7Vi:5GpblAB8RLBU+nT74cDzDqc5i

Score

10^/10

discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  f9da07ad6475a8b0215f03c4507dd22c_JaffaCakes118
- Size
  
  448KB
- MD5
  
  f9da07ad6475a8b0215f03c4507dd22c
- SHA1
  
  f166925a282b2b203d67df2e2691e2071dc7aacc
- SHA256
  
  39ec1bd1604c872851006d0439e6ae51e942a7d5d5f763f5c0c4524e8aee5646
- SHA512
  
  a62014783f09d4a525b439eea59543299fe18e123bd65abc680d35fe364d23fc8ce9f65529302693b331232ef604caa13ecd3c0b30ce9720d4a265e6c81ddd94
- SSDEEP
  
  12288:PBGpbBfAB8RvDB4N+nT74cWgr/x3jDqc7Vi:5GpblAB8RLBU+nT74cDzDqc5i
Score

10^/10

discovery evasion persistence trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Disables taskbar notifications via registry modification
  evasion
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencetrojan

behavioral2