a6b9f36c4a18081e1772ace56a81ff67e94d7a6bd6b6fc81a35237c40656810c | Triage

Sharing

General

Target

ab723227b9b890069b937f7317e9d144_JaffaCakes118
Size

255KB
Sample

240819-r6jx2azfng
MD5

ab723227b9b890069b937f7317e9d144
SHA1

7ca4064ed37eed54d498ca3d4831b2b5b0ea583c
SHA256

a6b9f36c4a18081e1772ace56a81ff67e94d7a6bd6b6fc81a35237c40656810c
SHA512

27906415c03b7a6c6afc008eeac72a74e5dec30b3cbbc87a4883db1e6f9c26095b478e02a1fd6795536ecf1d230227e3e53aeb53b450c34731b65b1470015157
SSDEEP

6144:P4TE1mRi76B3R7XM7WTXJqBD1p2bz3xCBv5+ALP:P441b76B3hXM7WAl2bz3QP+S

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  ab723227b9b890069b937f7317e9d144_JaffaCakes118
- Size
  
  255KB
- MD5
  
  ab723227b9b890069b937f7317e9d144
- SHA1
  
  7ca4064ed37eed54d498ca3d4831b2b5b0ea583c
- SHA256
  
  a6b9f36c4a18081e1772ace56a81ff67e94d7a6bd6b6fc81a35237c40656810c
- SHA512
  
  27906415c03b7a6c6afc008eeac72a74e5dec30b3cbbc87a4883db1e6f9c26095b478e02a1fd6795536ecf1d230227e3e53aeb53b450c34731b65b1470015157
- SSDEEP
  
  6144:P4TE1mRi76B3R7XM7WTXJqBD1p2bz3xCBv5+ALP:P441b76B3hXM7WAl2bz3QP+S
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2