22488744831468c4f7484b664284bd3f7e6179a1e34a962cb80bf2de300a3181 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

da6ecf54de05698e54f9723e4a9da6f2_JaffaCakes118
Size

297KB
Sample

240911-ql3c7ssgne
MD5

da6ecf54de05698e54f9723e4a9da6f2
SHA1

c18fc31398ba3c36826a985286ae41c175b75f73
SHA256

22488744831468c4f7484b664284bd3f7e6179a1e34a962cb80bf2de300a3181
SHA512

694ea696440a1f01ed8b5a8276e820236cefbacea9066ae688395ef9030b89f4f4f87eecea366665b892ff44e8a2e4fe4d699e698def1546343d208c3f34dee1
SSDEEP

6144:dZ28rD30pnAFGBalAZVM4uU6cVlx2h8z7ZKXIwvIiKdgi6Clo+PO55YLAYR:dZ28rDEhAYBal2vufcVD247ZKYoIic9P

Score

7^/10

discovery persistence upx

Malware Config

Targets

- Target
  
  da6ecf54de05698e54f9723e4a9da6f2_JaffaCakes118
- Size
  
  297KB
- MD5
  
  da6ecf54de05698e54f9723e4a9da6f2
- SHA1
  
  c18fc31398ba3c36826a985286ae41c175b75f73
- SHA256
  
  22488744831468c4f7484b664284bd3f7e6179a1e34a962cb80bf2de300a3181
- SHA512
  
  694ea696440a1f01ed8b5a8276e820236cefbacea9066ae688395ef9030b89f4f4f87eecea366665b892ff44e8a2e4fe4d699e698def1546343d208c3f34dee1
- SSDEEP
  
  6144:dZ28rD30pnAFGBalAZVM4uU6cVlx2h8z7ZKXIwvIiKdgi6Clo+PO55YLAYR:dZ28rDEhAYBal2vufcVD247ZKYoIic9P
Score

7^/10

discovery persistence upx
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistenceupx

behavioral2