59702f378c665fedd87d3d98d652e83ba72b8c028fe5aef44233d83e009b123d | Triage

Sharing

General

Target

957e2bbc9f7ee3830a56672b11250ee9_JaffaCakes118
Size

356KB
Sample

240814-lcdahayhqn
MD5

957e2bbc9f7ee3830a56672b11250ee9
SHA1

81ad26a50bb036c2d2f784a370b473da81410fd4
SHA256

59702f378c665fedd87d3d98d652e83ba72b8c028fe5aef44233d83e009b123d
SHA512

f807f3a24b48c858d767ba05c5c1549a75475ff01589bc6bf7bf9b9da968fac020c7dd3ac475a7074732fc37c56e6ffc148eb168d9278d2b15ea71220a31d5f2
SSDEEP

6144:7vbx8Gv1pFM7UipZAViHo6YsU5Fi91EzGHsZUa:7Xv1Y7UUZAVj6JUbigGHct

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  957e2bbc9f7ee3830a56672b11250ee9_JaffaCakes118
- Size
  
  356KB
- MD5
  
  957e2bbc9f7ee3830a56672b11250ee9
- SHA1
  
  81ad26a50bb036c2d2f784a370b473da81410fd4
- SHA256
  
  59702f378c665fedd87d3d98d652e83ba72b8c028fe5aef44233d83e009b123d
- SHA512
  
  f807f3a24b48c858d767ba05c5c1549a75475ff01589bc6bf7bf9b9da968fac020c7dd3ac475a7074732fc37c56e6ffc148eb168d9278d2b15ea71220a31d5f2
- SSDEEP
  
  6144:7vbx8Gv1pFM7UipZAViHo6YsU5Fi91EzGHsZUa:7Xv1Y7UUZAVj6JUbigGHct
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence