5f1c5a4e6b24ebb182d7911a75f0f605c1a6a4f0966fc902b82991312052b092 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f1aa0cea52ea4af830905427d34a8c63_JaffaCakes118
Size

506KB
Sample

240415-wp4ckafa5y
MD5

f1aa0cea52ea4af830905427d34a8c63
SHA1

7a8c5e841fc6a54472d398cede62e3782e70f915
SHA256

5f1c5a4e6b24ebb182d7911a75f0f605c1a6a4f0966fc902b82991312052b092
SHA512

f57fa4e1969b4c55149b1441b299b9bcf27f6124dcf429a85f76d94d8d0159dc2bd8e2307cdc8691a17dd5db06ffea6e13f2564b18486a63f2f506c9918a19ce
SSDEEP

12288:u+jnPShaWiAqDiFaxjGjOdELlck9QwRLpPmJVd7vrnxp:Njno4L9GEUcORLxm/pnr

Score

7^/10

Malware Config

Targets

- Target
  
  f1aa0cea52ea4af830905427d34a8c63_JaffaCakes118
- Size
  
  506KB
- MD5
  
  f1aa0cea52ea4af830905427d34a8c63
- SHA1
  
  7a8c5e841fc6a54472d398cede62e3782e70f915
- SHA256
  
  5f1c5a4e6b24ebb182d7911a75f0f605c1a6a4f0966fc902b82991312052b092
- SHA512
  
  f57fa4e1969b4c55149b1441b299b9bcf27f6124dcf429a85f76d94d8d0159dc2bd8e2307cdc8691a17dd5db06ffea6e13f2564b18486a63f2f506c9918a19ce
- SSDEEP
  
  12288:u+jnPShaWiAqDiFaxjGjOdELlck9QwRLpPmJVd7vrnxp:Njno4L9GEUcORLxm/pnr
Score

7^/10
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2