c179df3235c0e7e820186eb3147e5305ebd0e5399d37c45aa232bb643d3824f2 | Triage

Sharing

General

Target

9730e701dad73a9d1e8119c13a721898_JaffaCakes118
Size

262KB
Sample

240814-w51avasbkp
MD5

9730e701dad73a9d1e8119c13a721898
SHA1

9c1b9d079cd0dbc82190c44fb401787efb3cff06
SHA256

c179df3235c0e7e820186eb3147e5305ebd0e5399d37c45aa232bb643d3824f2
SHA512

93159cddff7e95a526f270ab16f43b777eec6c957cf73a598623419758fcb32f2a5e94e0b3be105b9b59788634a3767fc6bf9c92c8223bf9a8c5473c2609c25b
SSDEEP

6144:uT8Gp+df0afmVTRMdGdpn94sLrNXel9cXb98+MAUr:I8YkfXf4TRM+94svNuzcb9Z+

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  9730e701dad73a9d1e8119c13a721898_JaffaCakes118
- Size
  
  262KB
- MD5
  
  9730e701dad73a9d1e8119c13a721898
- SHA1
  
  9c1b9d079cd0dbc82190c44fb401787efb3cff06
- SHA256
  
  c179df3235c0e7e820186eb3147e5305ebd0e5399d37c45aa232bb643d3824f2
- SHA512
  
  93159cddff7e95a526f270ab16f43b777eec6c957cf73a598623419758fcb32f2a5e94e0b3be105b9b59788634a3767fc6bf9c92c8223bf9a8c5473c2609c25b
- SSDEEP
  
  6144:uT8Gp+df0afmVTRMdGdpn94sLrNXel9cXb98+MAUr:I8YkfXf4TRM+94svNuzcb9Z+
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2