da5f03cf34171671cc803552295a97f43b8d3a3a46175ec3ddd2bbb87f98390d | Triage

Sharing

General

Target

b1f9c7be22df49e420213305af9bb0f8_JaffaCakes118
Size

296KB
Sample

240821-d82nzasbqk
MD5

b1f9c7be22df49e420213305af9bb0f8
SHA1

0136e9b14101537fc8648ee03e00dc0966b84762
SHA256

da5f03cf34171671cc803552295a97f43b8d3a3a46175ec3ddd2bbb87f98390d
SHA512

6e28f26b90ca7998103ef92f892be2c71744f75dfb486147daf040c4e209c2026608e42fbe313e791beac11c6ed81746c9d40a6d395878b6d58d636b75129db4
SSDEEP

6144:75IOtHLMIhNC632wgWCI+Y0VvhpT4OsUP/cKsoJ:75PhNL32wgWB+Y0VEOj8KjJ

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  b1f9c7be22df49e420213305af9bb0f8_JaffaCakes118
- Size
  
  296KB
- MD5
  
  b1f9c7be22df49e420213305af9bb0f8
- SHA1
  
  0136e9b14101537fc8648ee03e00dc0966b84762
- SHA256
  
  da5f03cf34171671cc803552295a97f43b8d3a3a46175ec3ddd2bbb87f98390d
- SHA512
  
  6e28f26b90ca7998103ef92f892be2c71744f75dfb486147daf040c4e209c2026608e42fbe313e791beac11c6ed81746c9d40a6d395878b6d58d636b75129db4
- SSDEEP
  
  6144:75IOtHLMIhNC632wgWCI+Y0VvhpT4OsUP/cKsoJ:75PhNL32wgWB+Y0VEOj8KjJ
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence