488343abc8048d7e196fb187a07a0d2fe92b0be3f4efcee529aeacb564bf758b | Triage

Sharing

General

Target

f6237172c491fac7775548b5fded5a92_JaffaCakes118
Size

1000KB
Sample

240417-tcqjtsgb2x
MD5

f6237172c491fac7775548b5fded5a92
SHA1

1e01eb59120bd417db9dcf377bf11520c8e59756
SHA256

488343abc8048d7e196fb187a07a0d2fe92b0be3f4efcee529aeacb564bf758b
SHA512

57bdcfe73e91797c0cd818103575213a47717a65963f5f0a0b69530aed009001ef9fe907a478683ccbf30a816bca3bf35f94b6938732aca821ef1782eabf4d82
SSDEEP

24576:QUGaP6xszCL9c1FaWMi/m1B+5vMiqt0gj2ed:QZ6wRLKopi/EqOL

Score

7^/10

Malware Config

Targets

- Target
  
  f6237172c491fac7775548b5fded5a92_JaffaCakes118
- Size
  
  1000KB
- MD5
  
  f6237172c491fac7775548b5fded5a92
- SHA1
  
  1e01eb59120bd417db9dcf377bf11520c8e59756
- SHA256
  
  488343abc8048d7e196fb187a07a0d2fe92b0be3f4efcee529aeacb564bf758b
- SHA512
  
  57bdcfe73e91797c0cd818103575213a47717a65963f5f0a0b69530aed009001ef9fe907a478683ccbf30a816bca3bf35f94b6938732aca821ef1782eabf4d82
- SSDEEP
  
  24576:QUGaP6xszCL9c1FaWMi/m1B+5vMiqt0gj2ed:QZ6wRLKopi/EqOL
Score

7^/10
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2