3d9a25c9c97fbc6c1d03a80fc2a791fa9280a1ed6e583888bc0e611d6eca5160 | Triage

Sharing

General

Target

da2ece5895dbff8e9fffe3f509c040cd_JaffaCakes118
Size

58KB
Sample

240911-mydzlaxakg
MD5

da2ece5895dbff8e9fffe3f509c040cd
SHA1

ae51628f26cf0765a797abaca35edf1c9d34a20d
SHA256

3d9a25c9c97fbc6c1d03a80fc2a791fa9280a1ed6e583888bc0e611d6eca5160
SHA512

04204772a0e6e7a86e0ab5c2d11a07513aaf951a27be129780a05751c0a0ee0ccbef00dcc25a61f2a6e90fd08e88d331451fb124a4c84fdf7e7c23e465446670
SSDEEP

1536:Q5S3+Dejk2aMZNa2pL88M7WzxuuzHHQ0fE1:YS3+yj5a0NP188M7WRTHQl

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  da2ece5895dbff8e9fffe3f509c040cd_JaffaCakes118
- Size
  
  58KB
- MD5
  
  da2ece5895dbff8e9fffe3f509c040cd
- SHA1
  
  ae51628f26cf0765a797abaca35edf1c9d34a20d
- SHA256
  
  3d9a25c9c97fbc6c1d03a80fc2a791fa9280a1ed6e583888bc0e611d6eca5160
- SHA512
  
  04204772a0e6e7a86e0ab5c2d11a07513aaf951a27be129780a05751c0a0ee0ccbef00dcc25a61f2a6e90fd08e88d331451fb124a4c84fdf7e7c23e465446670
- SSDEEP
  
  1536:Q5S3+Dejk2aMZNa2pL88M7WzxuuzHHQ0fE1:YS3+yj5a0NP188M7WRTHQl
Score

8^/10

discovery persistence
- Adds policy Run key to start application
  persistence
- Deletes itself
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence