2b031b5a8a0797a6f17d5f84e23ed2ffc505432982045494918f6191a0b53b78 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d64c36a4f67096321f7c313a5ac5a1e4_JaffaCakes118
Size

3.1MB
Sample

240909-phc4gazcnc
MD5

d64c36a4f67096321f7c313a5ac5a1e4
SHA1

4a206a5e453521b7601c472aa26d5ecdb815eb11
SHA256

2b031b5a8a0797a6f17d5f84e23ed2ffc505432982045494918f6191a0b53b78
SHA512

05696376b28666eb20847023214500e507be3af1cc036fa06fe1a8b5002b03546fe94d10c4773b388f5016847b61bf02e66bb7b0a93389aebfbfef5539b193b2
SSDEEP

49152:53ratU0lWmeeXl2r+f8A2c8Xo+jPDxvjBCNlhEgrq+mGiXB/xBaN1KVkezFLc:57h0lWg8Cj2c03iGD+YTBajKVk2L

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  d64c36a4f67096321f7c313a5ac5a1e4_JaffaCakes118
- Size
  
  3.1MB
- MD5
  
  d64c36a4f67096321f7c313a5ac5a1e4
- SHA1
  
  4a206a5e453521b7601c472aa26d5ecdb815eb11
- SHA256
  
  2b031b5a8a0797a6f17d5f84e23ed2ffc505432982045494918f6191a0b53b78
- SHA512
  
  05696376b28666eb20847023214500e507be3af1cc036fa06fe1a8b5002b03546fe94d10c4773b388f5016847b61bf02e66bb7b0a93389aebfbfef5539b193b2
- SSDEEP
  
  49152:53ratU0lWmeeXl2r+f8A2c8Xo+jPDxvjBCNlhEgrq+mGiXB/xBaN1KVkezFLc:57h0lWg8Cj2c03iGD+YTBajKVk2L
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence