blackshades | 2935b3a19475d9da72c9a8408a469ac40fa7fa034148755a5f41e366ee45f75d | Triage

Sharing

General

Target

JaffaCakes118_2f77ca14d4574992f9b24d04ad3fe23b
Size

412KB
Sample

250227-zja1lsyrv8
MD5

2f77ca14d4574992f9b24d04ad3fe23b
SHA1

526c7a71dc639cf7e5e5f9489e27226e632cd909
SHA256

2935b3a19475d9da72c9a8408a469ac40fa7fa034148755a5f41e366ee45f75d
SHA512

af270b0c72046aaac274613e1539fbaf2c3b2b8671efb2a7336b0f61cd494e66fac157aff0dc302be287b4140de63d9a0c1ec7a13128f12484502e3ba3ba5bc5
SSDEEP

6144:yE7pMoc0VP7BHng5HaQKMyOiRqIl52TmUuon4ua0vD1+PuRIAOp:ywSsdgaVfR54mUuon4ua0vx+PCQp

Score

10^/10

blackshades defense_evasion discovery persistence

Malware Config

Targets

- Target
  
  JaffaCakes118_2f77ca14d4574992f9b24d04ad3fe23b
- Size
  
  412KB
- MD5
  
  2f77ca14d4574992f9b24d04ad3fe23b
- SHA1
  
  526c7a71dc639cf7e5e5f9489e27226e632cd909
- SHA256
  
  2935b3a19475d9da72c9a8408a469ac40fa7fa034148755a5f41e366ee45f75d
- SHA512
  
  af270b0c72046aaac274613e1539fbaf2c3b2b8671efb2a7336b0f61cd494e66fac157aff0dc302be287b4140de63d9a0c1ec7a13128f12484502e3ba3ba5bc5
- SSDEEP
  
  6144:yE7pMoc0VP7BHng5HaQKMyOiRqIl52TmUuon4ua0vD1+PuRIAOp:ywSsdgaVfR54mUuon4ua0vx+PCQp
Score

10^/10

defense_evasion discovery persistence
- Modifies firewall policy service
  defense_evasion
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoverypersistence

behavioral2

defense_evasiondiscoverypersistence