56be412d7af0e2b256e40b566bf5b4481ba3d2dd9ad0e416f9c186a484946422 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fe56e32268d9353a18d713abd723e4a5_JaffaCakes118
Size

506KB
Sample

240421-d7xnmaaa74
MD5

fe56e32268d9353a18d713abd723e4a5
SHA1

267cb1e4b9243e8485241580e90f5704d9a84f84
SHA256

56be412d7af0e2b256e40b566bf5b4481ba3d2dd9ad0e416f9c186a484946422
SHA512

9c68a55a691d61439c70bf189aa03d40eb7351b6ee0c3f58825edc4a6a29600331b912bd7fa0f52b3206a03637602353f5d8f5250f996331e4838cc9b89f3cc7
SSDEEP

12288:9HNdW7hSL3UckBXVqsujJ/eXgJfZ+NbNd3kkyD4P/ZqD4vkFyPh:9XjL3UckB8BowJR+fV1yDG/Yscch

Score

7^/10

Malware Config

Targets

- Target
  
  fe56e32268d9353a18d713abd723e4a5_JaffaCakes118
- Size
  
  506KB
- MD5
  
  fe56e32268d9353a18d713abd723e4a5
- SHA1
  
  267cb1e4b9243e8485241580e90f5704d9a84f84
- SHA256
  
  56be412d7af0e2b256e40b566bf5b4481ba3d2dd9ad0e416f9c186a484946422
- SHA512
  
  9c68a55a691d61439c70bf189aa03d40eb7351b6ee0c3f58825edc4a6a29600331b912bd7fa0f52b3206a03637602353f5d8f5250f996331e4838cc9b89f3cc7
- SSDEEP
  
  12288:9HNdW7hSL3UckBXVqsujJ/eXgJfZ+NbNd3kkyD4P/ZqD4vkFyPh:9XjL3UckB8BowJR+fV1yDG/Yscch
Score

7^/10
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2