ccb6b5d240349db832910326c06e5199a093853222f2419275fc2368cee6bde7 | Triage

Sharing

General

Target

9f05e85994fb10053e78b1e7ac522e99_JaffaCakes118
Size

88KB
Sample

241126-bqwznawpft
MD5

9f05e85994fb10053e78b1e7ac522e99
SHA1

acb3b6f737bf79308bb791d044116e3804539f0f
SHA256

ccb6b5d240349db832910326c06e5199a093853222f2419275fc2368cee6bde7
SHA512

2e6df67c33fcd9976861b981b708d7c42d56eb9e2566efe41b5066a4f17cab0efd4dee8c4785ac5b354707130f130977dd8a1ae8c2fd2533195cfe64b5340f1b
SSDEEP

1536:nw3YT90CV/DmUU8gUrnAmMTYf3KpUoP+9aXX7A2IYzUGMD+pRR5GgEARUxq:bT9LpmSrokf3W7AdYzbMIHRQq

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  9f05e85994fb10053e78b1e7ac522e99_JaffaCakes118
- Size
  
  88KB
- MD5
  
  9f05e85994fb10053e78b1e7ac522e99
- SHA1
  
  acb3b6f737bf79308bb791d044116e3804539f0f
- SHA256
  
  ccb6b5d240349db832910326c06e5199a093853222f2419275fc2368cee6bde7
- SHA512
  
  2e6df67c33fcd9976861b981b708d7c42d56eb9e2566efe41b5066a4f17cab0efd4dee8c4785ac5b354707130f130977dd8a1ae8c2fd2533195cfe64b5340f1b
- SSDEEP
  
  1536:nw3YT90CV/DmUU8gUrnAmMTYf3KpUoP+9aXX7A2IYzUGMD+pRR5GgEARUxq:bT9LpmSrokf3W7AdYzbMIHRQq
Score

10^/10

discovery evasion persistence
- Modifies firewall policy service
  evasion
- Adds policy Run key to start application
  persistence
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoveryevasionpersistence