f464e49900bfe2fb8f568a8906b78eeedc5f6582df6b15ec20ce4f7f94cace1a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

40fb7c28b5bdfadae6b9ee40326b10bc_JaffaCakes118
Size

1.0MB
Sample

241013-vbx3ys1eqk
MD5

40fb7c28b5bdfadae6b9ee40326b10bc
SHA1

a8ae2b8425d144eb7246c52517072f35330b697e
SHA256

f464e49900bfe2fb8f568a8906b78eeedc5f6582df6b15ec20ce4f7f94cace1a
SHA512

64de6f4565b641c0e746ec60e6ed92d462e63e46c453f583c389dfaea231a03b29f532dbba28b78517d2f6291451d6098e902244257a595bf9b36040657255cb
SSDEEP

24576:uXQKznLsKA4bTlV9vwSfeqsxC3oh4Rj5xrYIKsIq:QFTl7vyYUQ9Kq

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  40fb7c28b5bdfadae6b9ee40326b10bc_JaffaCakes118
- Size
  
  1.0MB
- MD5
  
  40fb7c28b5bdfadae6b9ee40326b10bc
- SHA1
  
  a8ae2b8425d144eb7246c52517072f35330b697e
- SHA256
  
  f464e49900bfe2fb8f568a8906b78eeedc5f6582df6b15ec20ce4f7f94cace1a
- SHA512
  
  64de6f4565b641c0e746ec60e6ed92d462e63e46c453f583c389dfaea231a03b29f532dbba28b78517d2f6291451d6098e902244257a595bf9b36040657255cb
- SSDEEP
  
  24576:uXQKznLsKA4bTlV9vwSfeqsxC3oh4Rj5xrYIKsIq:QFTl7vyYUQ9Kq
Score

7^/10

discovery persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence