cd6924bbcd2d2f745aae7b2c3e89fbdc79a47ff150e9fb01bb1376675d283692 | Triage

Sharing

General

Target

16aabd8d1b020647ddf7a729cea386da_JaffaCakes118
Size

276KB
Sample

241005-hy6x6awekg
MD5

16aabd8d1b020647ddf7a729cea386da
SHA1

9d14e6d8676a71b54e9cb1f2392ce55531903264
SHA256

cd6924bbcd2d2f745aae7b2c3e89fbdc79a47ff150e9fb01bb1376675d283692
SHA512

1beaca1aa2012e430121c60fb52caf368178f982539a4abada0d7c41c4c4ee889eea083b8d227db106837686d9180656e6ad10afb1889d47323af8c7c6e88642
SSDEEP

6144:lvIj8Nfc6oK0zat8GzwzkIXfYnPY9lrhdMwPTKSM/3NVa4:lQjCcrK0qjIQnAYwPGS63a4

Score

8^/10

defense_evasion discovery persistence upx

Malware Config

Targets

- Target
  
  16aabd8d1b020647ddf7a729cea386da_JaffaCakes118
- Size
  
  276KB
- MD5
  
  16aabd8d1b020647ddf7a729cea386da
- SHA1
  
  9d14e6d8676a71b54e9cb1f2392ce55531903264
- SHA256
  
  cd6924bbcd2d2f745aae7b2c3e89fbdc79a47ff150e9fb01bb1376675d283692
- SHA512
  
  1beaca1aa2012e430121c60fb52caf368178f982539a4abada0d7c41c4c4ee889eea083b8d227db106837686d9180656e6ad10afb1889d47323af8c7c6e88642
- SSDEEP
  
  6144:lvIj8Nfc6oK0zat8GzwzkIXfYnPY9lrhdMwPTKSM/3NVa4:lQjCcrK0qjIQnAYwPGS63a4
Score

8^/10

defense_evasion discovery persistence upx
- Drops file in Drivers directory
- Sets service image path in registry
  persistence
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Change Default File Association

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoverypersistenceupx

behavioral2

defense_evasiondiscoverypersistenceupx