2496d2642fd66fa73e274ef4fa9b80c630d3aaa967d9a8b2e5dcf97d0dccd1cb | Triage

Sharing

General

Target

e9bf13f27ac4e3dc066192981dedd07d_JaffaCakes118
Size

1000KB
Sample

240409-l5mpmsff3w
MD5

e9bf13f27ac4e3dc066192981dedd07d
SHA1

9cae7c484fff1d6b2aad6c991971cbbc5fe15bda
SHA256

2496d2642fd66fa73e274ef4fa9b80c630d3aaa967d9a8b2e5dcf97d0dccd1cb
SHA512

e7b5a14fad9b9221f4e3d4956c72f93851dcca16ad68edd3576deda4d58e6ff2c1797ddee69505cf0302cc8d105f718906b95aad8a855e6b49e55628d35babe1
SSDEEP

24576:GKBv6V82JBzsDZ+HXvVolQoQZsis1m1wBIMHyoNYk8Cl7G/qY4Hc1AToEO1B+5vK:hv6V8azsDZ+HXvVolQo8fMm1wBIMHyMA

Score

7^/10

Malware Config

Targets

- Target
  
  e9bf13f27ac4e3dc066192981dedd07d_JaffaCakes118
- Size
  
  1000KB
- MD5
  
  e9bf13f27ac4e3dc066192981dedd07d
- SHA1
  
  9cae7c484fff1d6b2aad6c991971cbbc5fe15bda
- SHA256
  
  2496d2642fd66fa73e274ef4fa9b80c630d3aaa967d9a8b2e5dcf97d0dccd1cb
- SHA512
  
  e7b5a14fad9b9221f4e3d4956c72f93851dcca16ad68edd3576deda4d58e6ff2c1797ddee69505cf0302cc8d105f718906b95aad8a855e6b49e55628d35babe1
- SSDEEP
  
  24576:GKBv6V82JBzsDZ+HXvVolQoQZsis1m1wBIMHyoNYk8Cl7G/qY4Hc1AToEO1B+5vK:hv6V8azsDZ+HXvVolQo8fMm1wBIMHyMA
Score

7^/10
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2