a99627df830ef9e4119eda79cdc9f379785f3651007e927f79d50a0e50401284 | Triage

Sharing

General

Target

d28fe996d3f2aed7309512422bfedc20_JaffaCakes118
Size

307KB
Sample

240907-wza4rszdnd
MD5

d28fe996d3f2aed7309512422bfedc20
SHA1

a278b27bc13d9f9f8cc3c7dd847d3c2042bb0756
SHA256

a99627df830ef9e4119eda79cdc9f379785f3651007e927f79d50a0e50401284
SHA512

4ebbc5ba15ad7bea82cae5bb000d5ea414144e0b60a8460b18ba5b7353412f0ebb677818a1e055b51dbb2a5f2af1578dbe3a09611f17f069ec240ace4a8e570b
SSDEEP

6144:2qzUT72Y0SdzinYKTY1SQshfRPVQe1MZkIYSccr7wbstOVPECYeixlYGickz:2CI7SSUYsY1UMqMZJYSN7wbstOV8fveh

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  d28fe996d3f2aed7309512422bfedc20_JaffaCakes118
- Size
  
  307KB
- MD5
  
  d28fe996d3f2aed7309512422bfedc20
- SHA1
  
  a278b27bc13d9f9f8cc3c7dd847d3c2042bb0756
- SHA256
  
  a99627df830ef9e4119eda79cdc9f379785f3651007e927f79d50a0e50401284
- SHA512
  
  4ebbc5ba15ad7bea82cae5bb000d5ea414144e0b60a8460b18ba5b7353412f0ebb677818a1e055b51dbb2a5f2af1578dbe3a09611f17f069ec240ace4a8e570b
- SSDEEP
  
  6144:2qzUT72Y0SdzinYKTY1SQshfRPVQe1MZkIYSccr7wbstOVPECYeixlYGickz:2CI7SSUYsY1UMqMZJYSN7wbstOV8fveh
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2