f60f1180dc02f79fbf4099df886ab702b80437ba91988a30c7278dd0f9533c86 | Triage

Sharing

General

Target

f6390702d11b15540637f5220e73911e_JaffaCakes118
Size

506KB
Sample

240417-t8weyshb6w
MD5

f6390702d11b15540637f5220e73911e
SHA1

5653b4c8d83fd790eaf57bef37959550de37c3b9
SHA256

f60f1180dc02f79fbf4099df886ab702b80437ba91988a30c7278dd0f9533c86
SHA512

77b7a19d1675f5bd5bca725fe705f6b13e18e0681939b440794a2f10a8fa2735b675cdae5e4a93578585cb8ab2df64924cd2bcf70fcec1aa501ee217c642b7f8
SSDEEP

12288:AemQ3EGnPp6COnYecpYtemUBS/KYhS3kmAiEemNXh:A1Q3EePXqtcqemUy7mAXrNR

Score

7^/10

Malware Config

Targets

- Target
  
  f6390702d11b15540637f5220e73911e_JaffaCakes118
- Size
  
  506KB
- MD5
  
  f6390702d11b15540637f5220e73911e
- SHA1
  
  5653b4c8d83fd790eaf57bef37959550de37c3b9
- SHA256
  
  f60f1180dc02f79fbf4099df886ab702b80437ba91988a30c7278dd0f9533c86
- SHA512
  
  77b7a19d1675f5bd5bca725fe705f6b13e18e0681939b440794a2f10a8fa2735b675cdae5e4a93578585cb8ab2df64924cd2bcf70fcec1aa501ee217c642b7f8
- SSDEEP
  
  12288:AemQ3EGnPp6COnYecpYtemUBS/KYhS3kmAiEemNXh:A1Q3EePXqtcqemUy7mAXrNR
Score

7^/10
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2