ec0c322d984aa6e74d531bd74b9ef4a684e073575a0b82ad389729d1b1f79e8b | Triage

Sharing

General

Target

eab346aada56f251dd794be47b912a86_JaffaCakes118
Size

20KB
Sample

240919-ghy2yatfqn
MD5

eab346aada56f251dd794be47b912a86
SHA1

310e430e24900eaa82fe5afa12d6340f9161c1b8
SHA256

ec0c322d984aa6e74d531bd74b9ef4a684e073575a0b82ad389729d1b1f79e8b
SHA512

c538fff346361d58d56574200390920f430b416ca39a3a93abd41b19934e58d1d910a6ed2031f036af407a2fbe08041c9667378a0cca99d777d0deda7f48d4aa
SSDEEP

192:yn0V1obEOXACLFlRLupKLbI7lid3zjC9UCCgM9cXK2mSRDQRj3c4Ck+tAt:yn0Va1QURLupKHUspYUPgM9m7uh0At

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  eab346aada56f251dd794be47b912a86_JaffaCakes118
- Size
  
  20KB
- MD5
  
  eab346aada56f251dd794be47b912a86
- SHA1
  
  310e430e24900eaa82fe5afa12d6340f9161c1b8
- SHA256
  
  ec0c322d984aa6e74d531bd74b9ef4a684e073575a0b82ad389729d1b1f79e8b
- SHA512
  
  c538fff346361d58d56574200390920f430b416ca39a3a93abd41b19934e58d1d910a6ed2031f036af407a2fbe08041c9667378a0cca99d777d0deda7f48d4aa
- SSDEEP
  
  192:yn0V1obEOXACLFlRLupKLbI7lid3zjC9UCCgM9cXK2mSRDQRj3c4Ck+tAt:yn0Va1QURLupKHUspYUPgM9m7uh0At
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2