fa38b339f09d974f60c7d0ad77d0287a12905ff0643e49f42f00b4cc8886104c | Triage

Sharing

General

Target

df04bb0ba87079022f837f6d1d7f2049_JaffaCakes118
Size

310KB
Sample

240913-2e52asseqk
MD5

df04bb0ba87079022f837f6d1d7f2049
SHA1

437f9be814850b27349c32f2f8f1f055a2b7c3c8
SHA256

fa38b339f09d974f60c7d0ad77d0287a12905ff0643e49f42f00b4cc8886104c
SHA512

6e09440235d0e70b1e666053f7b077b816ecc167f691ea620480cdb5b9682df1fa4dd5bba940ac52d56ef64e6a1f790bd0ca173232d3dd87698a7d9981d64b2a
SSDEEP

6144:uVSkyL6YM4U/takNXkHQZvFv3M8v2HZAF5+NPun2wjHlIITE:kSkyTMZ/5XDvR325AF4NPuvDlr

Score

7^/10

discovery persistence upx

Malware Config

Targets

- Target
  
  df04bb0ba87079022f837f6d1d7f2049_JaffaCakes118
- Size
  
  310KB
- MD5
  
  df04bb0ba87079022f837f6d1d7f2049
- SHA1
  
  437f9be814850b27349c32f2f8f1f055a2b7c3c8
- SHA256
  
  fa38b339f09d974f60c7d0ad77d0287a12905ff0643e49f42f00b4cc8886104c
- SHA512
  
  6e09440235d0e70b1e666053f7b077b816ecc167f691ea620480cdb5b9682df1fa4dd5bba940ac52d56ef64e6a1f790bd0ca173232d3dd87698a7d9981d64b2a
- SSDEEP
  
  6144:uVSkyL6YM4U/takNXkHQZvFv3M8v2HZAF5+NPun2wjHlIITE:kSkyTMZ/5XDvR325AF4NPuvDlr
Score

7^/10

discovery persistence upx
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistenceupx

behavioral2