e3b67ec69afd52e6a9ee27dd6ea77b15285b12849356d5689afb8d327d7d7b73 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0e0a4c9960b9143ab5a70fbae7c74e2a_JaffaCakes118
Size

642KB
Sample

241003-fnq3vazbme
MD5

0e0a4c9960b9143ab5a70fbae7c74e2a
SHA1

a5332f753e1b71e60d07562c2b81503a9bcef6c7
SHA256

e3b67ec69afd52e6a9ee27dd6ea77b15285b12849356d5689afb8d327d7d7b73
SHA512

26a7df14947841649b1e4cece7cdf74e14bef6d0b52c46f14dfc779c91cbdc7d02c6d7e485fe3bf9c0c1926efe0d9e3bc5ef90f4458c612af6d2af43a2ad6fae
SSDEEP

12288:DRDqynULxpTevganZl5ArYma68qSICBrpMW9hUmNFgtQXk+:tDfULxnan6rYo8/LMW97nFXj

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  0e0a4c9960b9143ab5a70fbae7c74e2a_JaffaCakes118
- Size
  
  642KB
- MD5
  
  0e0a4c9960b9143ab5a70fbae7c74e2a
- SHA1
  
  a5332f753e1b71e60d07562c2b81503a9bcef6c7
- SHA256
  
  e3b67ec69afd52e6a9ee27dd6ea77b15285b12849356d5689afb8d327d7d7b73
- SHA512
  
  26a7df14947841649b1e4cece7cdf74e14bef6d0b52c46f14dfc779c91cbdc7d02c6d7e485fe3bf9c0c1926efe0d9e3bc5ef90f4458c612af6d2af43a2ad6fae
- SSDEEP
  
  12288:DRDqynULxpTevganZl5ArYma68qSICBrpMW9hUmNFgtQXk+:tDfULxnan6rYo8/LMW97nFXj
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence