3ecd36abb0f3b2ce6e28226ec04d2f5295203dc7ab96bc9dd26a2ea189b18fd0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

852845dc7f125f1a61660fdfd46d6ac6_JaffaCakes118
Size

356KB
Sample

240810-hkeazsterc
MD5

852845dc7f125f1a61660fdfd46d6ac6
SHA1

d81a99e65738fbc26c1526d379ae703ea9b5471f
SHA256

3ecd36abb0f3b2ce6e28226ec04d2f5295203dc7ab96bc9dd26a2ea189b18fd0
SHA512

3236d1be14876042130fd732ec30d258b7f243250f063efda969a17a9cd2efe9a5c8743d81c13d9dbdccd57994e11385e04fff8beff2516f765a4c97c3f347b0
SSDEEP

6144:7vbx8hiNeR6mX20cVNi8diK66o72njEV7H4C2i:7yX2jjdlGqn4s

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  852845dc7f125f1a61660fdfd46d6ac6_JaffaCakes118
- Size
  
  356KB
- MD5
  
  852845dc7f125f1a61660fdfd46d6ac6
- SHA1
  
  d81a99e65738fbc26c1526d379ae703ea9b5471f
- SHA256
  
  3ecd36abb0f3b2ce6e28226ec04d2f5295203dc7ab96bc9dd26a2ea189b18fd0
- SHA512
  
  3236d1be14876042130fd732ec30d258b7f243250f063efda969a17a9cd2efe9a5c8743d81c13d9dbdccd57994e11385e04fff8beff2516f765a4c97c3f347b0
- SSDEEP
  
  6144:7vbx8hiNeR6mX20cVNi8diK66o72njEV7H4C2i:7yX2jjdlGqn4s
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence