87da0ff2c29bf64a12ea6f6d5d7853eddce576b9dc8fde4ee75f5bff60bc9913 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7805e4b0da9cb824e862fbff4549ba7b_JaffaCakes118
Size

236KB
Sample

240727-nfvp3axaqq
MD5

7805e4b0da9cb824e862fbff4549ba7b
SHA1

c4f2253a0fff9a017cb7c7eb34ed6d8d6eea44b2
SHA256

87da0ff2c29bf64a12ea6f6d5d7853eddce576b9dc8fde4ee75f5bff60bc9913
SHA512

95119731341f3ab2054170f3f0071bcd75a500c8170a71257aab29168da998b5062323c058c19fbd1fb46b3b927f7b03c195b2ae32dda23c423b3a30c10dc18c
SSDEEP

6144:IZPLI/97RtQWotF5ZcyKQPHZfcOJ/Q6HCPJWh:IZC7RtQfFrcyKQPFzBFgWh

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  7805e4b0da9cb824e862fbff4549ba7b_JaffaCakes118
- Size
  
  236KB
- MD5
  
  7805e4b0da9cb824e862fbff4549ba7b
- SHA1
  
  c4f2253a0fff9a017cb7c7eb34ed6d8d6eea44b2
- SHA256
  
  87da0ff2c29bf64a12ea6f6d5d7853eddce576b9dc8fde4ee75f5bff60bc9913
- SHA512
  
  95119731341f3ab2054170f3f0071bcd75a500c8170a71257aab29168da998b5062323c058c19fbd1fb46b3b927f7b03c195b2ae32dda23c423b3a30c10dc18c
- SSDEEP
  
  6144:IZPLI/97RtQWotF5ZcyKQPHZfcOJ/Q6HCPJWh:IZC7RtQfFrcyKQPFzBFgWh
Score

8^/10

discovery persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence