d1205a5c8157527ea8135cffa89ac01a972366084fd7f313210b19785a4e817b | Triage

Sharing

General

Target

8661ef65a0eaa16386086c46913f5fa6_JaffaCakes118
Size

249KB
Sample

240810-rlqvvashlj
MD5

8661ef65a0eaa16386086c46913f5fa6
SHA1

3e9fbda4da29881456343b778a01b13bceada094
SHA256

d1205a5c8157527ea8135cffa89ac01a972366084fd7f313210b19785a4e817b
SHA512

59717ab34d6c1ef8162359ec9d4bb36661c165d588c71b9c7d77dd251aeb4b63d140565ccab02852adb73bfc26ce67b79388e1f737a4dc6b021f446c7c5a4319
SSDEEP

6144:eWq8/eR6p0yN90QE1BRYU+d0rwqR6M3hIP:L/eBy905RP+d0Eq48

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  8661ef65a0eaa16386086c46913f5fa6_JaffaCakes118
- Size
  
  249KB
- MD5
  
  8661ef65a0eaa16386086c46913f5fa6
- SHA1
  
  3e9fbda4da29881456343b778a01b13bceada094
- SHA256
  
  d1205a5c8157527ea8135cffa89ac01a972366084fd7f313210b19785a4e817b
- SHA512
  
  59717ab34d6c1ef8162359ec9d4bb36661c165d588c71b9c7d77dd251aeb4b63d140565ccab02852adb73bfc26ce67b79388e1f737a4dc6b021f446c7c5a4319
- SSDEEP
  
  6144:eWq8/eR6p0yN90QE1BRYU+d0rwqR6M3hIP:L/eBy905RP+d0Eq48
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence