97a6c7e975ae6462ad73e76846b4fcf66c7fd38a30b51939a6b8f7bf8b0ad6d2 | Triage

Sharing

General

Target

890a69bbd3bc119a853ed5202be98d08_JaffaCakes118
Size

524KB
Sample

240811-fc8thszcpe
MD5

890a69bbd3bc119a853ed5202be98d08
SHA1

dce8646a48c3e4c441024b524197017db3efe9c5
SHA256

97a6c7e975ae6462ad73e76846b4fcf66c7fd38a30b51939a6b8f7bf8b0ad6d2
SHA512

543ebadf06caca835ca40882b718dbf99e5190b2a5adecf18c4f319bfbc7b05beaeb41f43b5fa70e261be02d7806a869520fd43b30a806fdc5b3b26bd1b312c8
SSDEEP

6144:atmFCDimSR6YJ7EfX6Rn469n1gVjfOYKvlkZN:YDDeJb4hIg

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  890a69bbd3bc119a853ed5202be98d08_JaffaCakes118
- Size
  
  524KB
- MD5
  
  890a69bbd3bc119a853ed5202be98d08
- SHA1
  
  dce8646a48c3e4c441024b524197017db3efe9c5
- SHA256
  
  97a6c7e975ae6462ad73e76846b4fcf66c7fd38a30b51939a6b8f7bf8b0ad6d2
- SHA512
  
  543ebadf06caca835ca40882b718dbf99e5190b2a5adecf18c4f319bfbc7b05beaeb41f43b5fa70e261be02d7806a869520fd43b30a806fdc5b3b26bd1b312c8
- SSDEEP
  
  6144:atmFCDimSR6YJ7EfX6Rn469n1gVjfOYKvlkZN:YDDeJb4hIg
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2