ab2ace673c6a0adc090d38f821fa6e742b489e95cc5157e1544a6ffcea74c1e0 | Triage

Sharing

General

Target

09124d57a418b3c3fffbb6a215f002d3_JaffaCakes118
Size

20KB
Sample

241002-fz2nqasgka
MD5

09124d57a418b3c3fffbb6a215f002d3
SHA1

f2e52c955cdee51ab43cb956c6ad7bfd6613c29d
SHA256

ab2ace673c6a0adc090d38f821fa6e742b489e95cc5157e1544a6ffcea74c1e0
SHA512

5d3c9ecf77b34aeb5acef4ee68f76565f5c693b521c7cdb2d5dd4f05ecc58bbfab597cb3e7f605d17f7819c066cd4ecf813e17ae0afe567ef23bea4a2d71caa8
SSDEEP

192:8R7AXojFG5rCbaNaiLGpKLb2QUFicDswJ+6UCc5v9/1F2sWJ5M8o93C8CcVETGWR:t4jFG6DjpKHGMcDs8Uxnfkq8o9XuiK7

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  09124d57a418b3c3fffbb6a215f002d3_JaffaCakes118
- Size
  
  20KB
- MD5
  
  09124d57a418b3c3fffbb6a215f002d3
- SHA1
  
  f2e52c955cdee51ab43cb956c6ad7bfd6613c29d
- SHA256
  
  ab2ace673c6a0adc090d38f821fa6e742b489e95cc5157e1544a6ffcea74c1e0
- SHA512
  
  5d3c9ecf77b34aeb5acef4ee68f76565f5c693b521c7cdb2d5dd4f05ecc58bbfab597cb3e7f605d17f7819c066cd4ecf813e17ae0afe567ef23bea4a2d71caa8
- SSDEEP
  
  192:8R7AXojFG5rCbaNaiLGpKLb2QUFicDswJ+6UCc5v9/1F2sWJ5M8o93C8CcVETGWR:t4jFG6DjpKHGMcDs8Uxnfkq8o9XuiK7
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2