70def2086a9c1a23fcb307c8bf51922be28a7cc37b72be672ccdc913bda30ccc | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bfa480d9ced1edb65ff21f94b00397fd_JaffaCakes118
Size

56KB
Sample

240824-3cnjxavhla
MD5

bfa480d9ced1edb65ff21f94b00397fd
SHA1

967f9a2a795584556119cd43e89ebdbfd2c0245e
SHA256

70def2086a9c1a23fcb307c8bf51922be28a7cc37b72be672ccdc913bda30ccc
SHA512

e1c93a4e1c98a9a1b7116a0eb47bc0be57ac9200ce15d7b4cd8bbe5b85e8f46720dcdbaf15c3c5c8729f3228b76d5e0fa8562d3591f479ef037ffe21eb5a3259
SSDEEP

768:O90YRgFYEC6O9WnQHhjfzikLG/y6GA4kEtFkrV4afJbV:uhUf0ACTukLGvYtFAVBb

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  bfa480d9ced1edb65ff21f94b00397fd_JaffaCakes118
- Size
  
  56KB
- MD5
  
  bfa480d9ced1edb65ff21f94b00397fd
- SHA1
  
  967f9a2a795584556119cd43e89ebdbfd2c0245e
- SHA256
  
  70def2086a9c1a23fcb307c8bf51922be28a7cc37b72be672ccdc913bda30ccc
- SHA512
  
  e1c93a4e1c98a9a1b7116a0eb47bc0be57ac9200ce15d7b4cd8bbe5b85e8f46720dcdbaf15c3c5c8729f3228b76d5e0fa8562d3591f479ef037ffe21eb5a3259
- SSDEEP
  
  768:O90YRgFYEC6O9WnQHhjfzikLG/y6GA4kEtFkrV4afJbV:uhUf0ACTukLGvYtFAVBb
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2