bf1e7d6995e59d1238d48a6a3ef797f37f5986bad6fbf1a4c4b66e8f85b05cec | Triage

Sharing

General

Target

8a842d5e1eccc2a3e5ddd0a3ef37e67b_JaffaCakes118
Size

693KB
Sample

240811-ql3c7s1dpq
MD5

8a842d5e1eccc2a3e5ddd0a3ef37e67b
SHA1

4d87129619c8873d62dff15a64cadb1744616cc0
SHA256

bf1e7d6995e59d1238d48a6a3ef797f37f5986bad6fbf1a4c4b66e8f85b05cec
SHA512

30934420955e19c1a548e05ce70581de02ac44d3391ea1c839b061cf5a25201370f7f6c85586c0b9ed3f88635e0a4aec6a31145e3e49b99e1a4b35032d72c3c0
SSDEEP

12288:8Wji9ZJ/XQ7m4vwcYyt7z0NqLcf0SNSGh7iZsrTpWwYwH:PWZ/A9YMt7INqL67d+srTn

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  8a842d5e1eccc2a3e5ddd0a3ef37e67b_JaffaCakes118
- Size
  
  693KB
- MD5
  
  8a842d5e1eccc2a3e5ddd0a3ef37e67b
- SHA1
  
  4d87129619c8873d62dff15a64cadb1744616cc0
- SHA256
  
  bf1e7d6995e59d1238d48a6a3ef797f37f5986bad6fbf1a4c4b66e8f85b05cec
- SHA512
  
  30934420955e19c1a548e05ce70581de02ac44d3391ea1c839b061cf5a25201370f7f6c85586c0b9ed3f88635e0a4aec6a31145e3e49b99e1a4b35032d72c3c0
- SSDEEP
  
  12288:8Wji9ZJ/XQ7m4vwcYyt7z0NqLcf0SNSGh7iZsrTpWwYwH:PWZ/A9YMt7INqL67d+srTn
Score

8^/10

discovery persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence