52b3c34a278d37cba4db6b785c4d3b130b6340304564bc2c38023e1fc915527f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8d3f3e12b1a049dc88ceea654d148c5f_JaffaCakes118
Size

169KB
Sample

240812-enqlmsvbqj
MD5

8d3f3e12b1a049dc88ceea654d148c5f
SHA1

b5e6730ffeb18adb01ca1c2e3657ac823fe30c13
SHA256

52b3c34a278d37cba4db6b785c4d3b130b6340304564bc2c38023e1fc915527f
SHA512

2b009123aa0d2253d9e04a9eaf412d8a080d3a953189295531b646e59d6035899c2aa34998c6bb813a6401d3a03a4e58ed9aace0bf55a6db6072d0b29c5ba1f8
SSDEEP

3072:DLuC9XN6Q22l61bgI3fZD5uA9vfB0q1wdNp9Txfs5Bw0/Cq5:19d6Qdl8ffv4fp9T0BzN5

Score

7^/10

discovery

Malware Config

Targets

- Target
  
  8d3f3e12b1a049dc88ceea654d148c5f_JaffaCakes118
- Size
  
  169KB
- MD5
  
  8d3f3e12b1a049dc88ceea654d148c5f
- SHA1
  
  b5e6730ffeb18adb01ca1c2e3657ac823fe30c13
- SHA256
  
  52b3c34a278d37cba4db6b785c4d3b130b6340304564bc2c38023e1fc915527f
- SHA512
  
  2b009123aa0d2253d9e04a9eaf412d8a080d3a953189295531b646e59d6035899c2aa34998c6bb813a6401d3a03a4e58ed9aace0bf55a6db6072d0b29c5ba1f8
- SSDEEP
  
  3072:DLuC9XN6Q22l61bgI3fZD5uA9vfB0q1wdNp9Txfs5Bw0/Cq5:19d6Qdl8ffv4fp9T0BzN5
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2