26f22a1a9d7af7d9ba4d79adb8ae550c452ef98b0920c1c9afafa52c4ce649a7 | Triage

Sharing

General

Target

de46c953b26ba6b1b25d2594c309da31_JaffaCakes118
Size

320KB
Sample

240913-n6hs7a1amc
MD5

de46c953b26ba6b1b25d2594c309da31
SHA1

a64325de2d7eb49aeb41dddabe3dfc3083fb8253
SHA256

26f22a1a9d7af7d9ba4d79adb8ae550c452ef98b0920c1c9afafa52c4ce649a7
SHA512

a9d27e261b44631a5797e711c0ee88f2e0d02dc111b0a0fb0f3ca154fd465871c41c32895af606fd32b780a2956db7ad34082122472d44597d31a102cde55d5c
SSDEEP

6144:qF0jzdT9d941odtA89nQynoeJcFBVHuE24qEDRjS:qKjzZ9d93dtAQX6VHu5QDo

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  de46c953b26ba6b1b25d2594c309da31_JaffaCakes118
- Size
  
  320KB
- MD5
  
  de46c953b26ba6b1b25d2594c309da31
- SHA1
  
  a64325de2d7eb49aeb41dddabe3dfc3083fb8253
- SHA256
  
  26f22a1a9d7af7d9ba4d79adb8ae550c452ef98b0920c1c9afafa52c4ce649a7
- SHA512
  
  a9d27e261b44631a5797e711c0ee88f2e0d02dc111b0a0fb0f3ca154fd465871c41c32895af606fd32b780a2956db7ad34082122472d44597d31a102cde55d5c
- SSDEEP
  
  6144:qF0jzdT9d941odtA89nQynoeJcFBVHuE24qEDRjS:qKjzZ9d93dtAQX6VHu5QDo
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2