9435adb201110308b389ba5cb2f935de96a0190cc347dc28cbf7a41da45fe387 | Triage

Sharing

General

Target

983b7c98aae7dd6b3e370c5c3d8d404a_JaffaCakes118
Size

262KB
Sample

240815-ahl9tayeql
MD5

983b7c98aae7dd6b3e370c5c3d8d404a
SHA1

bfd6d26c2c573d3ba9859f391cb430678fed167a
SHA256

9435adb201110308b389ba5cb2f935de96a0190cc347dc28cbf7a41da45fe387
SHA512

429987cb8851d4d62f851a22275a56ae3d84a5e829835767fe71ca6c11a45cfb7aa132c312a4d3b3ca8ff5c2d20dea9d9fb472e2b3a43183ac1e2ae9b8c98cd7
SSDEEP

6144:2jJ8Gp+df0afmVTRMdQdpn94sLrNXel9Fb98+MAv6:uJ8YkfXf4TRMA94svNuzFb9ZU

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  983b7c98aae7dd6b3e370c5c3d8d404a_JaffaCakes118
- Size
  
  262KB
- MD5
  
  983b7c98aae7dd6b3e370c5c3d8d404a
- SHA1
  
  bfd6d26c2c573d3ba9859f391cb430678fed167a
- SHA256
  
  9435adb201110308b389ba5cb2f935de96a0190cc347dc28cbf7a41da45fe387
- SHA512
  
  429987cb8851d4d62f851a22275a56ae3d84a5e829835767fe71ca6c11a45cfb7aa132c312a4d3b3ca8ff5c2d20dea9d9fb472e2b3a43183ac1e2ae9b8c98cd7
- SSDEEP
  
  6144:2jJ8Gp+df0afmVTRMdQdpn94sLrNXel9Fb98+MAv6:uJ8YkfXf4TRMA94svNuzFb9ZU
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2