10e99ab136ccbc6c466cc38ea9ea70260ce5e3f1acd6c6c1825a78c74ae97a42 | Triage

Sharing

General

Target

72055a377c08037a8481403644be11eb_JaffaCakes118
Size

309KB
Sample

240726-bkfeqawhpq
MD5

72055a377c08037a8481403644be11eb
SHA1

9f7a8032adb587047c2dcaa6067d323e8f578762
SHA256

10e99ab136ccbc6c466cc38ea9ea70260ce5e3f1acd6c6c1825a78c74ae97a42
SHA512

6b0258ffb1aa555f5c634b0e938375d5d9e56f90bceb06b7b8eff871a9bfb6785d79979778442310baa521e7e0a82f486bdbabfbae5637e4caf4dac0dfa5e500
SSDEEP

6144:GwhzQ9Skr2I6jFZNp0H8vIz3YX5Sze2wpchpkUJ1HLBh4kHIJ:GrSM6jtQTKk9h1HLAJ

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  72055a377c08037a8481403644be11eb_JaffaCakes118
- Size
  
  309KB
- MD5
  
  72055a377c08037a8481403644be11eb
- SHA1
  
  9f7a8032adb587047c2dcaa6067d323e8f578762
- SHA256
  
  10e99ab136ccbc6c466cc38ea9ea70260ce5e3f1acd6c6c1825a78c74ae97a42
- SHA512
  
  6b0258ffb1aa555f5c634b0e938375d5d9e56f90bceb06b7b8eff871a9bfb6785d79979778442310baa521e7e0a82f486bdbabfbae5637e4caf4dac0dfa5e500
- SSDEEP
  
  6144:GwhzQ9Skr2I6jFZNp0H8vIz3YX5Sze2wpchpkUJ1HLBh4kHIJ:GrSM6jtQTKk9h1HLAJ
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2