d5c57d5bbadfbbc34008a91f411e6f5b6821073b8fc5c629661ad800ddf10918 | Triage

Sharing

General

Target

9ee65f785d4480376250b8fa48b573fe_JaffaCakes118
Size

98KB
Sample

241126-a8anpsskek
MD5

9ee65f785d4480376250b8fa48b573fe
SHA1

9b6fc772d8331e9b8e5102bfe7a05a1adcf2aa94
SHA256

d5c57d5bbadfbbc34008a91f411e6f5b6821073b8fc5c629661ad800ddf10918
SHA512

6cc47b9651f2ecd2c636713f61eab7dd6bccfa6445edbdef807e7ff856c857189ca59e0065a7e03a909aa0bef8619dab7d8b596d19ef31747f2eb5a312453c5f
SSDEEP

3072:1bIOHjY5SsWuQckHq8Z0Zfk5JxVSOgakkm7FZ+out:tHsQckK8KC53ATn+oS

Score

8^/10

defense_evasion discovery persistence privilege_escalation vmprotect

Malware Config

Targets

- Target
  
  9ee65f785d4480376250b8fa48b573fe_JaffaCakes118
- Size
  
  98KB
- MD5
  
  9ee65f785d4480376250b8fa48b573fe
- SHA1
  
  9b6fc772d8331e9b8e5102bfe7a05a1adcf2aa94
- SHA256
  
  d5c57d5bbadfbbc34008a91f411e6f5b6821073b8fc5c629661ad800ddf10918
- SHA512
  
  6cc47b9651f2ecd2c636713f61eab7dd6bccfa6445edbdef807e7ff856c857189ca59e0065a7e03a909aa0bef8619dab7d8b596d19ef31747f2eb5a312453c5f
- SSDEEP
  
  3072:1bIOHjY5SsWuQckHq8Z0Zfk5JxVSOgakkm7FZ+out:tHsQckK8KC53ATn+oS
Score

8^/10

defense_evasion discovery persistence privilege_escalation vmprotect
- Drops file in Drivers directory
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Adds Run key to start application
  persistence
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

AppInit DLLs

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

AppInit DLLs

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoverypersistenceprivilege_escalationvmprotect

behavioral2

defense_evasiondiscoverypersistenceprivilege_escalationvmprotect