b394810f960459d683316463f67f7c95a2b2cdc736573b0b021f630f1b5754e3 | Triage

Sharing

General

Target

faa68f4cac61953b31bd4fdf8e11f765_JaffaCakes118
Size

186KB
Sample

240927-srsgasyejk
MD5

faa68f4cac61953b31bd4fdf8e11f765
SHA1

62aa856e75853bd4c7b96fe20d2dc34b448944da
SHA256

b394810f960459d683316463f67f7c95a2b2cdc736573b0b021f630f1b5754e3
SHA512

663474d3724ad9e96038900044f4c9f096f482542d727e60b9e7a48f481c07e21e544926ae20c71e58d00967a064565e940c409c0775847593c60cc32f8cbb4d
SSDEEP

3072:4LbKuZKzXw2RjwkfqrIWUEbskfsmbL9Nn0uNFi+O0xShCzukYr+:ehKDHpwspcb4mn9Nr5OCgCzuBK

Score

7^/10

discovery

Malware Config

Targets

- Target
  
  faa68f4cac61953b31bd4fdf8e11f765_JaffaCakes118
- Size
  
  186KB
- MD5
  
  faa68f4cac61953b31bd4fdf8e11f765
- SHA1
  
  62aa856e75853bd4c7b96fe20d2dc34b448944da
- SHA256
  
  b394810f960459d683316463f67f7c95a2b2cdc736573b0b021f630f1b5754e3
- SHA512
  
  663474d3724ad9e96038900044f4c9f096f482542d727e60b9e7a48f481c07e21e544926ae20c71e58d00967a064565e940c409c0775847593c60cc32f8cbb4d
- SSDEEP
  
  3072:4LbKuZKzXw2RjwkfqrIWUEbskfsmbL9Nn0uNFi+O0xShCzukYr+:ehKDHpwspcb4mn9Nr5OCgCzuBK
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2