9382056f5e3723b4708bfe2c3bfb10799a8b4ad821fe6fb164fcdd790d95bcf0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4a6ea1abb8bae280947a6b016aa34923_JaffaCakes118
Size

1.4MB
Sample

240715-tqbmtsyfnk
MD5

4a6ea1abb8bae280947a6b016aa34923
SHA1

ecd38b192c420df9012b0338909d1b3b55ace1bd
SHA256

9382056f5e3723b4708bfe2c3bfb10799a8b4ad821fe6fb164fcdd790d95bcf0
SHA512

af34279d8dfb91908db92935481f59268a6212356d8d536d0b3ed301c380dc2a2c27bb277deb38caa315f5305485c2493e9004bb03719024d36654e58ffa1022
SSDEEP

24576:Wag10mh+RRh57yHv9qmG7hkB3Ip0287EP8HwlKvZuwf/lCzq9ysnLY8u87cfzm2q:WjGmo3c9qU2RjaYl1C2lFW

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  4a6ea1abb8bae280947a6b016aa34923_JaffaCakes118
- Size
  
  1.4MB
- MD5
  
  4a6ea1abb8bae280947a6b016aa34923
- SHA1
  
  ecd38b192c420df9012b0338909d1b3b55ace1bd
- SHA256
  
  9382056f5e3723b4708bfe2c3bfb10799a8b4ad821fe6fb164fcdd790d95bcf0
- SHA512
  
  af34279d8dfb91908db92935481f59268a6212356d8d536d0b3ed301c380dc2a2c27bb277deb38caa315f5305485c2493e9004bb03719024d36654e58ffa1022
- SSDEEP
  
  24576:Wag10mh+RRh57yHv9qmG7hkB3Ip0287EP8HwlKvZuwf/lCzq9ysnLY8u87cfzm2q:WjGmo3c9qU2RjaYl1C2lFW
Score

8^/10

persistence
- Server Software Component: Terminal Services DLL
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

Terminal Services DLL

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2