c5728d15d6a9534bf6a1d47d15f7fafe0b72f5a802f75d05fe44adfe39672477 | Triage

Sharing

General

Target

fc2f7b1a581edb63843f3c04bd6d3bd1_JaffaCakes118
Size

204KB
Sample

240928-nc2n7ssgnj
MD5

fc2f7b1a581edb63843f3c04bd6d3bd1
SHA1

9a28a7dcd9d7c51e76bc638a3347a7b5c435a434
SHA256

c5728d15d6a9534bf6a1d47d15f7fafe0b72f5a802f75d05fe44adfe39672477
SHA512

998c7960d93e4070a60935902619129d329d94a76d3ea98fa08939a1b986d764207181a6ff376f4f5a345fdf8edc6a2ce847313e941cf2fe9379cb5e3cc19c9f
SSDEEP

3072:0eYLaCUtOV3LeASZhQJjF9GZ166UclFiIaYMiI6mH9YOkq8pyBOclWhvi:0EFuA4jF9GZJMtGOkq84BVM4

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  fc2f7b1a581edb63843f3c04bd6d3bd1_JaffaCakes118
- Size
  
  204KB
- MD5
  
  fc2f7b1a581edb63843f3c04bd6d3bd1
- SHA1
  
  9a28a7dcd9d7c51e76bc638a3347a7b5c435a434
- SHA256
  
  c5728d15d6a9534bf6a1d47d15f7fafe0b72f5a802f75d05fe44adfe39672477
- SHA512
  
  998c7960d93e4070a60935902619129d329d94a76d3ea98fa08939a1b986d764207181a6ff376f4f5a345fdf8edc6a2ce847313e941cf2fe9379cb5e3cc19c9f
- SSDEEP
  
  3072:0eYLaCUtOV3LeASZhQJjF9GZ166UclFiIaYMiI6mH9YOkq8pyBOclWhvi:0EFuA4jF9GZJMtGOkq84BVM4
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2