6b4def2181e10eb8c24d6401ebf5fd6b4a17e0d55557f6d1fcb56670549e8539 | Triage

Sharing

General

Target

fc9a542cd632f78bc76b696c3d3e35f3_JaffaCakes118
Size

241KB
Sample

240420-m2lhvafd6w
MD5

fc9a542cd632f78bc76b696c3d3e35f3
SHA1

124977cd336c74b944824c27c8ec4b3bf7818cd0
SHA256

6b4def2181e10eb8c24d6401ebf5fd6b4a17e0d55557f6d1fcb56670549e8539
SHA512

860cd0bdd606748bb5d4294acea1c3ee94225dab51aa76ce356d658de65b59a1082476f7b8c4898b7b7e5774e87852b95e2d565f0e6a6e067748a61ceb6745fd
SSDEEP

6144:o0Yzqa+DCtgaJH6IOSJn08lRQNILiyr59IggMiTWIYH:oHeaKGgaJdbQA9IjMilYH

Score

7^/10

Malware Config

Targets

- Target
  
  fc9a542cd632f78bc76b696c3d3e35f3_JaffaCakes118
- Size
  
  241KB
- MD5
  
  fc9a542cd632f78bc76b696c3d3e35f3
- SHA1
  
  124977cd336c74b944824c27c8ec4b3bf7818cd0
- SHA256
  
  6b4def2181e10eb8c24d6401ebf5fd6b4a17e0d55557f6d1fcb56670549e8539
- SHA512
  
  860cd0bdd606748bb5d4294acea1c3ee94225dab51aa76ce356d658de65b59a1082476f7b8c4898b7b7e5774e87852b95e2d565f0e6a6e067748a61ceb6745fd
- SSDEEP
  
  6144:o0Yzqa+DCtgaJH6IOSJn08lRQNILiyr59IggMiTWIYH:oHeaKGgaJdbQA9IjMilYH
Score

7^/10
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2