721778ca9d9c2a547e534f7b3ec2c3064f27d689a331b7e51e7fd191ea141ba1 | Triage

Sharing

General

Target

eb1be45ca74b636121d6feb21fced212_JaffaCakes118
Size

295KB
Sample

240919-l6x7rstdnm
MD5

eb1be45ca74b636121d6feb21fced212
SHA1

05b5d2d50ad24a19fd66e4eaf3170442635b2e8e
SHA256

721778ca9d9c2a547e534f7b3ec2c3064f27d689a331b7e51e7fd191ea141ba1
SHA512

d4752e10f2a0abc4052af1a8061926fa9b921d7c8b8e7e4b9744680bd17bae611e43d2b549ce1847cb218e017064e14f9e3b977591a7451d12ddbadc4319db33
SSDEEP

6144:PiGtsLNAlqNC+M+1PTG/qm/PgCnmUSFMhl4b+M/oI29uKw:6GtsLKt+x1PTEn/iUSFM8b+rI25w

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  eb1be45ca74b636121d6feb21fced212_JaffaCakes118
- Size
  
  295KB
- MD5
  
  eb1be45ca74b636121d6feb21fced212
- SHA1
  
  05b5d2d50ad24a19fd66e4eaf3170442635b2e8e
- SHA256
  
  721778ca9d9c2a547e534f7b3ec2c3064f27d689a331b7e51e7fd191ea141ba1
- SHA512
  
  d4752e10f2a0abc4052af1a8061926fa9b921d7c8b8e7e4b9744680bd17bae611e43d2b549ce1847cb218e017064e14f9e3b977591a7451d12ddbadc4319db33
- SSDEEP
  
  6144:PiGtsLNAlqNC+M+1PTG/qm/PgCnmUSFMhl4b+M/oI29uKw:6GtsLKt+x1PTEn/iUSFM8b+rI25w
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2