2f48659dd00d9e1f4ff5c0b9aee3373cc57fe3f592ed50b6cd3d09db7449e966 | Triage

Sharing

General

Target

a667bbbe6a3110291250a15076aa5e46_JaffaCakes118
Size

282KB
Sample

240818-mecbnasblr
MD5

a667bbbe6a3110291250a15076aa5e46
SHA1

1e784f1a156e5ed848cb9a2c8f557b739a34be4a
SHA256

2f48659dd00d9e1f4ff5c0b9aee3373cc57fe3f592ed50b6cd3d09db7449e966
SHA512

0368facc79268744787ebae9ade7765facd2d6d62e96c9c6d053f9fa8b9f59484aadd8b0be2d8b05ff14d25a8c1fd591921f5af4cec2f1da9eeab304d9b6aaea
SSDEEP

6144:v52HPJAA9jslC3Nvju2NCjV+GenP8k3JTLLeR:h2HPJh9jJdjN+V+GenEIpLE

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  a667bbbe6a3110291250a15076aa5e46_JaffaCakes118
- Size
  
  282KB
- MD5
  
  a667bbbe6a3110291250a15076aa5e46
- SHA1
  
  1e784f1a156e5ed848cb9a2c8f557b739a34be4a
- SHA256
  
  2f48659dd00d9e1f4ff5c0b9aee3373cc57fe3f592ed50b6cd3d09db7449e966
- SHA512
  
  0368facc79268744787ebae9ade7765facd2d6d62e96c9c6d053f9fa8b9f59484aadd8b0be2d8b05ff14d25a8c1fd591921f5af4cec2f1da9eeab304d9b6aaea
- SSDEEP
  
  6144:v52HPJAA9jslC3Nvju2NCjV+GenP8k3JTLLeR:h2HPJh9jJdjN+V+GenEIpLE
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2