16f5973e443c033c0fc3537f53ad0454cec9c2cbccb2f7b58e2ce5a041d92889 | Triage

Sharing

General

Target

dc72fc1ccc72e2fc6a9d8ee95b5dc1a5_JaffaCakes118
Size

248KB
Sample

240912-r5zxvszbrc
MD5

dc72fc1ccc72e2fc6a9d8ee95b5dc1a5
SHA1

b7632733d6a136f650cfa815ae790abe7c386256
SHA256

16f5973e443c033c0fc3537f53ad0454cec9c2cbccb2f7b58e2ce5a041d92889
SHA512

e488fb857a8452f9924ca703fdfa1269b584522636cf02af9143830304795627f321d2b128dd58fe6aa454aa733e739ddfb362cafc18a807b361730eb0e4954c
SSDEEP

6144:5UA75n6jTLI9Cr8aI8sWs9KpcPhlpX3YW1400wLTU4:x56Br878xsApEhlpn400oU4

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  factura.Doc .exe
- Size
  
  316KB
- MD5
  
  6a742fda92d69762d107c078adf70ad3
- SHA1
  
  739f282d0fd97e29ae5211f076de165345885cf9
- SHA256
  
  b78c094b662f6aed75b48d0c4fcc6d5f302e59af9b9dabefb274c4828d65b9e0
- SHA512
  
  3b66b223c308a56b557959e8f539f4aa4ac893e5cb85dd0d71b94ba543a42d6b95b2179ef937630d4c53fdcaf1c84786255fc297017bcab80c953d6fdea2febc
- SSDEEP
  
  6144:IjDbTozsd9qV6hsp0bD6oVMPmIty5hTTJlw6Qw37jhbVRf19G3q:x4qssG6pP3Y5tPSwhvN98q
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2