399a07cb8e62e14926c917d66f33b1d2e441a8fc795ca26ac00514f8d96ce638 | Triage

Sharing

General

Target

dc9e2cc98b0524c2b5abaad61fb91e58_JaffaCakes118
Size

436KB
Sample

240912-t2ll6steqg
MD5

dc9e2cc98b0524c2b5abaad61fb91e58
SHA1

4fd78daa5a09be4d101ab770bb1dc4d82738252f
SHA256

399a07cb8e62e14926c917d66f33b1d2e441a8fc795ca26ac00514f8d96ce638
SHA512

d2c298bb706c81a0016143d7884f3e79c79007a7f332beae0037eb82e61ac087cdb0b29c1e2c57f45924d6616bcee0976ad8f401962bbeef5eac1b4558ad29e0
SSDEEP

6144:X3FY67ilNJFDUHsUYkVNTiAMHP8PmyCFvk/wVqAXB/LpcF/xjKDeMs3H3A4pTBy:lZ2HGNTiAMHPqCc45qBH1pTc

Score

7^/10

discovery

Malware Config

Targets

- Target
  
  dc9e2cc98b0524c2b5abaad61fb91e58_JaffaCakes118
- Size
  
  436KB
- MD5
  
  dc9e2cc98b0524c2b5abaad61fb91e58
- SHA1
  
  4fd78daa5a09be4d101ab770bb1dc4d82738252f
- SHA256
  
  399a07cb8e62e14926c917d66f33b1d2e441a8fc795ca26ac00514f8d96ce638
- SHA512
  
  d2c298bb706c81a0016143d7884f3e79c79007a7f332beae0037eb82e61ac087cdb0b29c1e2c57f45924d6616bcee0976ad8f401962bbeef5eac1b4558ad29e0
- SSDEEP
  
  6144:X3FY67ilNJFDUHsUYkVNTiAMHP8PmyCFvk/wVqAXB/LpcF/xjKDeMs3H3A4pTBy:lZ2HGNTiAMHPqCc45qBH1pTc
Score

7^/10

discovery
- Drops startup file
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2