237d55b49ac41381a844751b4549eab5b31a2fa0ca0e85ba0e1520d12066e681 | Triage

Sharing

General

Target

132686a054873689c8db2373e6aa5012_JaffaCakes118
Size

427KB
Sample

241004-nhqtwsvhlh
MD5

132686a054873689c8db2373e6aa5012
SHA1

84ba45ac416222f86d4dd11d0e42f92585534946
SHA256

237d55b49ac41381a844751b4549eab5b31a2fa0ca0e85ba0e1520d12066e681
SHA512

c13c3f673baa7bca290a8425e9ea0e1b7905a9ea2e6a11d25d9396bf7dd79126fca3624afa5d411c4f5f016b2e03d2bc325e724b0baef52d54f23e553a2fb467
SSDEEP

12288:lQJK0qjIQnAYwPzS3QkK0qjIQnAYwPGSa/I:lQJK0qjIGAYwP+AkK0qjIGAYwPGBI

Score

8^/10

defense_evasion discovery persistence upx

Malware Config

Targets

- Target
  
  132686a054873689c8db2373e6aa5012_JaffaCakes118
- Size
  
  427KB
- MD5
  
  132686a054873689c8db2373e6aa5012
- SHA1
  
  84ba45ac416222f86d4dd11d0e42f92585534946
- SHA256
  
  237d55b49ac41381a844751b4549eab5b31a2fa0ca0e85ba0e1520d12066e681
- SHA512
  
  c13c3f673baa7bca290a8425e9ea0e1b7905a9ea2e6a11d25d9396bf7dd79126fca3624afa5d411c4f5f016b2e03d2bc325e724b0baef52d54f23e553a2fb467
- SSDEEP
  
  12288:lQJK0qjIQnAYwPzS3QkK0qjIQnAYwPGSa/I:lQJK0qjIGAYwP+AkK0qjIGAYwPGBI
Score

8^/10

defense_evasion discovery persistence upx
- Drops file in Drivers directory
- Sets service image path in registry
  persistence
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Change Default File Association

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoverypersistenceupx

behavioral2

defense_evasiondiscoverypersistenceupx