f1db291cf1f81b6cd3a60ff6d25a79d1802f08d351d75080946a79e0b3666c86 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d63c5238e76a137fbe8cf6878855c238_JaffaCakes118
Size

84KB
Sample

240909-nsz6bayara
MD5

d63c5238e76a137fbe8cf6878855c238
SHA1

648ccde36d761e2d43d4c5702c1620b762f68de5
SHA256

f1db291cf1f81b6cd3a60ff6d25a79d1802f08d351d75080946a79e0b3666c86
SHA512

dfd9765e255f9e1af75e9a85cbfae80934bad7c275236ecda7a3d90c9964082f2ccbe23adfa63f32e2e8e921002f2cdd9a3da168e0732098fd8b325ec7337874
SSDEEP

1536:27R+ig8gGpCvKqdd07a0MJ9IDybgkqG4oRnWQJOt:25g8XpHqgtMiCgkjOt

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  d63c5238e76a137fbe8cf6878855c238_JaffaCakes118
- Size
  
  84KB
- MD5
  
  d63c5238e76a137fbe8cf6878855c238
- SHA1
  
  648ccde36d761e2d43d4c5702c1620b762f68de5
- SHA256
  
  f1db291cf1f81b6cd3a60ff6d25a79d1802f08d351d75080946a79e0b3666c86
- SHA512
  
  dfd9765e255f9e1af75e9a85cbfae80934bad7c275236ecda7a3d90c9964082f2ccbe23adfa63f32e2e8e921002f2cdd9a3da168e0732098fd8b325ec7337874
- SSDEEP
  
  1536:27R+ig8gGpCvKqdd07a0MJ9IDybgkqG4oRnWQJOt:25g8XpHqgtMiCgkjOt
Score

8^/10

discovery persistence
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence