56ae80ccafe3d1aaf1cc2c5a6896e2f85c1217a507d4796eeaa42ebf29c75d3d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f01981f8818792bec418291f4313d681_JaffaCakes118
Size

250KB
Sample

240921-sy2zbazckc
MD5

f01981f8818792bec418291f4313d681
SHA1

07e363ec3dd82afac788f18aac5055a1c643c5f0
SHA256

56ae80ccafe3d1aaf1cc2c5a6896e2f85c1217a507d4796eeaa42ebf29c75d3d
SHA512

24e7ba152e5f8a5e05d3b0bd86324fcac6db2c46b049ece8a9223b298c6335d35d2927336c49bf512451ed452a01c80c079527db772ce771833be6a41000bf71
SSDEEP

3072:YuWcULGKbAX7dKx/OwVk/F9wzc44YQvZ6ZF3XzpmrTCUook5BVtN9MIedDJsDt1:/yGKEMAn/F9wb45hOZDMk55BV/aDit1

Score

7^/10

discovery persistence upx

Malware Config

Targets

- Target
  
  f01981f8818792bec418291f4313d681_JaffaCakes118
- Size
  
  250KB
- MD5
  
  f01981f8818792bec418291f4313d681
- SHA1
  
  07e363ec3dd82afac788f18aac5055a1c643c5f0
- SHA256
  
  56ae80ccafe3d1aaf1cc2c5a6896e2f85c1217a507d4796eeaa42ebf29c75d3d
- SHA512
  
  24e7ba152e5f8a5e05d3b0bd86324fcac6db2c46b049ece8a9223b298c6335d35d2927336c49bf512451ed452a01c80c079527db772ce771833be6a41000bf71
- SSDEEP
  
  3072:YuWcULGKbAX7dKx/OwVk/F9wzc44YQvZ6ZF3XzpmrTCUook5BVtN9MIedDJsDt1:/yGKEMAn/F9wb45hOZDMk55BV/aDit1
Score

7^/10

discovery persistence upx
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistenceupx

behavioral2