ce5353d555db90731fa88b241f0cbca3af458243955de96c631b774280250e88 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bd46293e1dc0d63da88c3a151662e7ee_JaffaCakes118
Size

567KB
Sample

240823-1myrhs1bnm
MD5

bd46293e1dc0d63da88c3a151662e7ee
SHA1

d24e2579d51f72395c63f1b58cc803908fd47b7a
SHA256

ce5353d555db90731fa88b241f0cbca3af458243955de96c631b774280250e88
SHA512

af562c720a679ac249aa035bf6bd92bf5633c354481f2f12ff3229e0aa4b157a259514fbfbe31deb98d719412f27b04b55fa2cd5377832a9feb1f5c426d765d2
SSDEEP

12288:0PfUbGcThaP29kDD6iLf1QZ6A3wsPT1VqnBgGX7Ux8L4k7VWvM2q7f:0Pf9cThaekv6ixQZYk1gnBgGXvL4aVgK

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  bd46293e1dc0d63da88c3a151662e7ee_JaffaCakes118
- Size
  
  567KB
- MD5
  
  bd46293e1dc0d63da88c3a151662e7ee
- SHA1
  
  d24e2579d51f72395c63f1b58cc803908fd47b7a
- SHA256
  
  ce5353d555db90731fa88b241f0cbca3af458243955de96c631b774280250e88
- SHA512
  
  af562c720a679ac249aa035bf6bd92bf5633c354481f2f12ff3229e0aa4b157a259514fbfbe31deb98d719412f27b04b55fa2cd5377832a9feb1f5c426d765d2
- SSDEEP
  
  12288:0PfUbGcThaP29kDD6iLf1QZ6A3wsPT1VqnBgGX7Ux8L4k7VWvM2q7f:0Pf9cThaekv6ixQZYk1gnBgGXvL4aVgK
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence