cd1368db50c1b1e553ed4f200c06ed9cf342ad140b414e7e3dfa306d2a6335fe | Triage

Sharing

General

Target

a3baa4a1231ae7f0ffddcb977a4473a6_JaffaCakes118
Size

357KB
Sample

240817-xjwk7s1dlc
MD5

a3baa4a1231ae7f0ffddcb977a4473a6
SHA1

21c72722e1a5983fa70fb11a19c11fb767dc0149
SHA256

cd1368db50c1b1e553ed4f200c06ed9cf342ad140b414e7e3dfa306d2a6335fe
SHA512

80f5e3e804a319a40a16c36596b689230744bbb5b1fa2cc6751f7357ede635394bddfe40f7cc55e3b5d160d085af48131ff30b501a27f715294b679de9f7c5c2
SSDEEP

6144:M4//bqpBm1Hs3czyOxW8RjSqjAvzxCaQHkRE0ZjOEd4xEtpzbpY:M4rqpB6Hs3czfxW8B7jAv1CaXGIGGbC

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  a3baa4a1231ae7f0ffddcb977a4473a6_JaffaCakes118
- Size
  
  357KB
- MD5
  
  a3baa4a1231ae7f0ffddcb977a4473a6
- SHA1
  
  21c72722e1a5983fa70fb11a19c11fb767dc0149
- SHA256
  
  cd1368db50c1b1e553ed4f200c06ed9cf342ad140b414e7e3dfa306d2a6335fe
- SHA512
  
  80f5e3e804a319a40a16c36596b689230744bbb5b1fa2cc6751f7357ede635394bddfe40f7cc55e3b5d160d085af48131ff30b501a27f715294b679de9f7c5c2
- SSDEEP
  
  6144:M4//bqpBm1Hs3czyOxW8RjSqjAvzxCaQHkRE0ZjOEd4xEtpzbpY:M4rqpB6Hs3czfxW8B7jAv1CaXGIGGbC
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2