0f6cd4e8159b243b7de4a18711fc39624491759beccb01386438f52175aad4b1 | Triage

Sharing

General

Target

86c4c35439fd5cfe3aff15e8765e2050_JaffaCakes118
Size

345KB
Sample

240810-tree4s1elg
MD5

86c4c35439fd5cfe3aff15e8765e2050
SHA1

e12e37c922d5b97c055f5d82f1a6fa7db9ad3e66
SHA256

0f6cd4e8159b243b7de4a18711fc39624491759beccb01386438f52175aad4b1
SHA512

7858a9577ac4ce24d974914a2b25a7c2920c137bcc3dd2af91846bf618c85c6cff57d84a8e26a2840e48b23412ad5c41482a133c22d1958f7ccd674eadd5bd84
SSDEEP

6144:CO+v5qbv5qPyMmQpPmzs0dsa+Ql4oe4351qaey0YICpmpod:EqdqPRHPmzs0ebFi35befepmpI

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  86c4c35439fd5cfe3aff15e8765e2050_JaffaCakes118
- Size
  
  345KB
- MD5
  
  86c4c35439fd5cfe3aff15e8765e2050
- SHA1
  
  e12e37c922d5b97c055f5d82f1a6fa7db9ad3e66
- SHA256
  
  0f6cd4e8159b243b7de4a18711fc39624491759beccb01386438f52175aad4b1
- SHA512
  
  7858a9577ac4ce24d974914a2b25a7c2920c137bcc3dd2af91846bf618c85c6cff57d84a8e26a2840e48b23412ad5c41482a133c22d1958f7ccd674eadd5bd84
- SSDEEP
  
  6144:CO+v5qbv5qPyMmQpPmzs0dsa+Ql4oe4351qaey0YICpmpod:EqdqPRHPmzs0ebFi35befepmpI
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoverypersistence