2fd0b1fcc9c9f17058b74f7ed63709f5e0b5e94969645e8ec3ff8ae0e135d079 | Triage

Sharing

General

Target

d20a7c20f0f533ed5d225d27d14a90f0_JaffaCakes118
Size

277KB
Sample

240907-qrse7aycrf
MD5

d20a7c20f0f533ed5d225d27d14a90f0
SHA1

073a649e20cf4651d46a69c061a7ef9352b38b3f
SHA256

2fd0b1fcc9c9f17058b74f7ed63709f5e0b5e94969645e8ec3ff8ae0e135d079
SHA512

d17ef5696ad3fe3539a3efa0ca6302ff5e30174100fc9b8f08b53c0a6b023196b49955eb0280f2c6e8c7f8298ffb962e570e5fafeba6f391ea8fac1c255dc676
SSDEEP

6144:T4byG6rzysDrwsSSYXkrD77q3UwQi7IQCAEzoY:TolTkrwsSSY0n77OUZi7pCTo

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  d20a7c20f0f533ed5d225d27d14a90f0_JaffaCakes118
- Size
  
  277KB
- MD5
  
  d20a7c20f0f533ed5d225d27d14a90f0
- SHA1
  
  073a649e20cf4651d46a69c061a7ef9352b38b3f
- SHA256
  
  2fd0b1fcc9c9f17058b74f7ed63709f5e0b5e94969645e8ec3ff8ae0e135d079
- SHA512
  
  d17ef5696ad3fe3539a3efa0ca6302ff5e30174100fc9b8f08b53c0a6b023196b49955eb0280f2c6e8c7f8298ffb962e570e5fafeba6f391ea8fac1c255dc676
- SSDEEP
  
  6144:T4byG6rzysDrwsSSYXkrD77q3UwQi7IQCAEzoY:TolTkrwsSSY0n77OUZi7pCTo
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2