5bc75034d2615c38cd9fbf98a1c7b48902d019de5cc8dc03781712c25d9e8eeb | Triage

Sharing

General

Target

bc0768262670888a3eda3a6614fa7da3_JaffaCakes118
Size

311KB
Sample

240823-rcmrtsyanf
MD5

bc0768262670888a3eda3a6614fa7da3
SHA1

e457b09a6b75c4c455cc1d11ba418ba819ba6a16
SHA256

5bc75034d2615c38cd9fbf98a1c7b48902d019de5cc8dc03781712c25d9e8eeb
SHA512

d32049fce9f8073da54d89693b1551f401a3e70293a1b15ba044606804ec568d65b585f87744756a2408950cb70865cc1daca3a09ba2915de1de545f0e478b0b
SSDEEP

6144:2sbBLhz9/wAS64AqBuGp2hpEwWI41gY9sw:2sBNtVSzzuu6GIg

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  bc0768262670888a3eda3a6614fa7da3_JaffaCakes118
- Size
  
  311KB
- MD5
  
  bc0768262670888a3eda3a6614fa7da3
- SHA1
  
  e457b09a6b75c4c455cc1d11ba418ba819ba6a16
- SHA256
  
  5bc75034d2615c38cd9fbf98a1c7b48902d019de5cc8dc03781712c25d9e8eeb
- SHA512
  
  d32049fce9f8073da54d89693b1551f401a3e70293a1b15ba044606804ec568d65b585f87744756a2408950cb70865cc1daca3a09ba2915de1de545f0e478b0b
- SSDEEP
  
  6144:2sbBLhz9/wAS64AqBuGp2hpEwWI41gY9sw:2sBNtVSzzuu6GIg
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2