589102099622ea5e39289aee3819242650a5b5f418eb6827c4c60201a09161e2 | Triage

Sharing

General

Target

7580de5edbe07ae539d7021b092d2b29_JaffaCakes118
Size

262KB
Sample

240726-yqglasvbjf
MD5

7580de5edbe07ae539d7021b092d2b29
SHA1

d3839b47e35cc6c14872b164d71d137ef9211f70
SHA256

589102099622ea5e39289aee3819242650a5b5f418eb6827c4c60201a09161e2
SHA512

1b1555631e3f9510d0d1fdf2cabeee33b5408ee738358c3f2bceafd4c02b201d8ac00f21004eab8d56cc39ed4c9be7984e68df66187810dca6382fee8011f15e
SSDEEP

6144:HU8Gp+df0afmVTRMdOdpn94sLrNXel9jb98+MAkC:08YkfXf4TRMS94svNuzjb9ZD

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  7580de5edbe07ae539d7021b092d2b29_JaffaCakes118
- Size
  
  262KB
- MD5
  
  7580de5edbe07ae539d7021b092d2b29
- SHA1
  
  d3839b47e35cc6c14872b164d71d137ef9211f70
- SHA256
  
  589102099622ea5e39289aee3819242650a5b5f418eb6827c4c60201a09161e2
- SHA512
  
  1b1555631e3f9510d0d1fdf2cabeee33b5408ee738358c3f2bceafd4c02b201d8ac00f21004eab8d56cc39ed4c9be7984e68df66187810dca6382fee8011f15e
- SSDEEP
  
  6144:HU8Gp+df0afmVTRMdOdpn94sLrNXel9jb98+MAkC:08YkfXf4TRMS94svNuzjb9ZD
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2