899e3459a16c4c5c441481940e6b69f1595fee416285f5e5ef1abbbbc926e623 | Triage

Sharing

General

Target

f36ea361ff1c07fcac241b623d3e577e_JaffaCakes118
Size

506KB
Sample

240416-nzh6dabd51
MD5

f36ea361ff1c07fcac241b623d3e577e
SHA1

1cab055cfbca3eee1e4bce4f6f22f880976800e0
SHA256

899e3459a16c4c5c441481940e6b69f1595fee416285f5e5ef1abbbbc926e623
SHA512

1523acdad821bdade9aa996d758bb2dc53430204c444056585d4465783d628cd997ce02411556d90f1388f9ccd7913059d3c884f186dd2b1f3a2e9697cd45fc8
SSDEEP

12288:cCuzbfAZUeCiO/HiP0P3Im4NkotJYFbekVWssK4tRDEfxI:cCuzsaeHSC85JotgeIDI

Score

7^/10

Malware Config

Targets

- Target
  
  f36ea361ff1c07fcac241b623d3e577e_JaffaCakes118
- Size
  
  506KB
- MD5
  
  f36ea361ff1c07fcac241b623d3e577e
- SHA1
  
  1cab055cfbca3eee1e4bce4f6f22f880976800e0
- SHA256
  
  899e3459a16c4c5c441481940e6b69f1595fee416285f5e5ef1abbbbc926e623
- SHA512
  
  1523acdad821bdade9aa996d758bb2dc53430204c444056585d4465783d628cd997ce02411556d90f1388f9ccd7913059d3c884f186dd2b1f3a2e9697cd45fc8
- SSDEEP
  
  12288:cCuzbfAZUeCiO/HiP0P3Im4NkotJYFbekVWssK4tRDEfxI:cCuzsaeHSC85JotgeIDI
Score

7^/10
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2