16877a292fb6ba18fc004071aced9a24cfa55ca35d9ec95ffd3aeaae6495282b | Triage

Sharing

General

Target

c2583b2a459c0df65747f3b423c0d668_JaffaCakes118
Size

2.6MB
Sample

240826-fsqymsxajg
MD5

c2583b2a459c0df65747f3b423c0d668
SHA1

6eca86c5a9518763d39ca64f5a751b80bca99592
SHA256

16877a292fb6ba18fc004071aced9a24cfa55ca35d9ec95ffd3aeaae6495282b
SHA512

259b898465fc38d560ed981a7b313ad6646c8ffab407e14e667b4370a376dbc7e55b7ded5d92efbf3890086e61124a70cc096ca363a68eb048b05b640558cf4f
SSDEEP

49152:ujoKMzvkZH298JH1q2NdjNnJyzTg7hqq2aTodp0+l6Y77vBX4B1v:Kol8ZH201bFJ7MqCdp0vY77vg

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  c2583b2a459c0df65747f3b423c0d668_JaffaCakes118
- Size
  
  2.6MB
- MD5
  
  c2583b2a459c0df65747f3b423c0d668
- SHA1
  
  6eca86c5a9518763d39ca64f5a751b80bca99592
- SHA256
  
  16877a292fb6ba18fc004071aced9a24cfa55ca35d9ec95ffd3aeaae6495282b
- SHA512
  
  259b898465fc38d560ed981a7b313ad6646c8ffab407e14e667b4370a376dbc7e55b7ded5d92efbf3890086e61124a70cc096ca363a68eb048b05b640558cf4f
- SSDEEP
  
  49152:ujoKMzvkZH298JH1q2NdjNnJyzTg7hqq2aTodp0+l6Y77vBX4B1v:Kol8ZH201bFJ7MqCdp0vY77vg
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence