7b580982f51a23655fe4a29c002e96acae35fddda81a3323170bc0b07e20085f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

154eb98f75a60404c382f406394b7c00_JaffaCakes118
Size

388KB
Sample

241004-3gpyjawhqc
MD5

154eb98f75a60404c382f406394b7c00
SHA1

006fef100e415c58fb745a451094c715ddfd0cc8
SHA256

7b580982f51a23655fe4a29c002e96acae35fddda81a3323170bc0b07e20085f
SHA512

afbfb0b04b19b5643d80adba6f28de6cb74d84f5ce57af182cce1c735d53ee9de29ebad86f639ddd97831b25f4e6ed3b73f6d603376617292d5687aa28a222cb
SSDEEP

6144:Jq/+ep82m8Anc7amzdxyQEf5d+vheNaENwg6DutB4aeqq/SDrdmmklBnsz+uYo:Jz6MAamJxof5EheN9wg6NaeqUS0pmzoo

Score

8^/10

discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  154eb98f75a60404c382f406394b7c00_JaffaCakes118
- Size
  
  388KB
- MD5
  
  154eb98f75a60404c382f406394b7c00
- SHA1
  
  006fef100e415c58fb745a451094c715ddfd0cc8
- SHA256
  
  7b580982f51a23655fe4a29c002e96acae35fddda81a3323170bc0b07e20085f
- SHA512
  
  afbfb0b04b19b5643d80adba6f28de6cb74d84f5ce57af182cce1c735d53ee9de29ebad86f639ddd97831b25f4e6ed3b73f6d603376617292d5687aa28a222cb
- SSDEEP
  
  6144:Jq/+ep82m8Anc7amzdxyQEf5d+vheNaENwg6DutB4aeqq/SDrdmmklBnsz+uYo:Jz6MAamJxof5EheN9wg6NaeqUS0pmzoo
Score

8^/10

discovery evasion persistence trojan
- Downloads MZ/PE file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencetrojan

behavioral2

discoveryevasionpersistencetrojan