66c7f9516e0f564e90ac8fa9c783bc29c3a57bd98d76bae797945ee4a4495d71 | Triage

Sharing

General

Target

779156930f35c787b6db9d4a3c33cc05_JaffaCakes118
Size

293KB
Sample

240727-kmltys1bqf
MD5

779156930f35c787b6db9d4a3c33cc05
SHA1

171214c93c3fbe11e06480588bd38ef4f5b67981
SHA256

66c7f9516e0f564e90ac8fa9c783bc29c3a57bd98d76bae797945ee4a4495d71
SHA512

65bb46caa2607fc6703a1614227a804aef6749bdaa3b58a379615e971b3f47f4c9cc177c1536498ccc7a1e0d824048c8818c73b4f393dfca1b4b97aeab3f0e8c
SSDEEP

6144:EPdMyMANEVzGlcEDUl4qaRYVQ+CJTGbusJRhgnGXcjD7Xm2BeddhMHpmMDr:mNEh8cSLqdtCsisDhgnGABBedDMJmMX

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  779156930f35c787b6db9d4a3c33cc05_JaffaCakes118
- Size
  
  293KB
- MD5
  
  779156930f35c787b6db9d4a3c33cc05
- SHA1
  
  171214c93c3fbe11e06480588bd38ef4f5b67981
- SHA256
  
  66c7f9516e0f564e90ac8fa9c783bc29c3a57bd98d76bae797945ee4a4495d71
- SHA512
  
  65bb46caa2607fc6703a1614227a804aef6749bdaa3b58a379615e971b3f47f4c9cc177c1536498ccc7a1e0d824048c8818c73b4f393dfca1b4b97aeab3f0e8c
- SSDEEP
  
  6144:EPdMyMANEVzGlcEDUl4qaRYVQ+CJTGbusJRhgnGXcjD7Xm2BeddhMHpmMDr:mNEh8cSLqdtCsisDhgnGABBedDMJmMX
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2