fe74b95f4206c66f682145fe2d0de7f7ef04674082c61cba3afa3ad3c217ea49 | Triage

Sharing

General

Target

d44ff69480d56f5dbc6c7a54f75e342d_JaffaCakes118
Size

272KB
Sample

240908-n6twfsvdll
MD5

d44ff69480d56f5dbc6c7a54f75e342d
SHA1

6f6f28db929a307a7823e70087714651662a2afa
SHA256

fe74b95f4206c66f682145fe2d0de7f7ef04674082c61cba3afa3ad3c217ea49
SHA512

d935455b9f67a260676f123b9bc2d6fdf6c05338b3042cff187d5ff6e346e0652915dfcc1be51f2c99fe379fc0668e3eb47a1e602e2fc53c7716ee3357bab8d8
SSDEEP

3072:2KqM7xgT1jfHnyvVCe9n7cuqovIYhWYuKnBSDdNZ1nWEu5hJWrrxeTlKT5TqpZKZ:JxYfHnytCfyIYGKBodNZ1WEuAUo5

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  d44ff69480d56f5dbc6c7a54f75e342d_JaffaCakes118
- Size
  
  272KB
- MD5
  
  d44ff69480d56f5dbc6c7a54f75e342d
- SHA1
  
  6f6f28db929a307a7823e70087714651662a2afa
- SHA256
  
  fe74b95f4206c66f682145fe2d0de7f7ef04674082c61cba3afa3ad3c217ea49
- SHA512
  
  d935455b9f67a260676f123b9bc2d6fdf6c05338b3042cff187d5ff6e346e0652915dfcc1be51f2c99fe379fc0668e3eb47a1e602e2fc53c7716ee3357bab8d8
- SSDEEP
  
  3072:2KqM7xgT1jfHnyvVCe9n7cuqovIYhWYuKnBSDdNZ1nWEu5hJWrrxeTlKT5TqpZKZ:JxYfHnytCfyIYGKBodNZ1WEuAUo5
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2