5ef11d86338720054c23a54a78a04f6b541712d145f63e0f5dfc2b7fd5654759 | Triage

Sharing

General

Target

fe8c998af99fdff8c8a5330d789b0b2b_JaffaCakes118
Size

377KB
Sample

240929-pwqxgsvcqj
MD5

fe8c998af99fdff8c8a5330d789b0b2b
SHA1

8ec66f449c704b92c12378ce2c08142b3a5a2467
SHA256

5ef11d86338720054c23a54a78a04f6b541712d145f63e0f5dfc2b7fd5654759
SHA512

b27f3f947ac8bbb04b65086ebb38d8e583d5fbcf655bcba308849ad05f00fb312ee12b5f75add80b496f3621649df4c827a1b50596767cc4cc33d9a5cf83f212
SSDEEP

6144:qB8Eev8CcOsW1D8fBUUEv8a6dRPMfbt4xb7s5evZRAjs:qmEevXfsgofyUHREfbSbfvZz

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  fe8c998af99fdff8c8a5330d789b0b2b_JaffaCakes118
- Size
  
  377KB
- MD5
  
  fe8c998af99fdff8c8a5330d789b0b2b
- SHA1
  
  8ec66f449c704b92c12378ce2c08142b3a5a2467
- SHA256
  
  5ef11d86338720054c23a54a78a04f6b541712d145f63e0f5dfc2b7fd5654759
- SHA512
  
  b27f3f947ac8bbb04b65086ebb38d8e583d5fbcf655bcba308849ad05f00fb312ee12b5f75add80b496f3621649df4c827a1b50596767cc4cc33d9a5cf83f212
- SSDEEP
  
  6144:qB8Eev8CcOsW1D8fBUUEv8a6dRPMfbt4xb7s5evZRAjs:qmEevXfsgofyUHREfbSbfvZz
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2