440c90dcf04b3314204ec4b3f2c3418c7ffb0547143500134e3a5ea379525fc1 | Triage

Sharing

General

Target

3afc1e842a76f2cecb20f395dfa71630_JaffaCakes118
Size

148KB
Sample

241012-txkt3szbqe
MD5

3afc1e842a76f2cecb20f395dfa71630
SHA1

8edd1247ceda6aa51100b5b2f9d98eeee8ff8e8e
SHA256

440c90dcf04b3314204ec4b3f2c3418c7ffb0547143500134e3a5ea379525fc1
SHA512

d3fb4424e8686b4aeb2162936359cb4256d25420e60a51d7b4ea1a6c41614096ff9b7efac4bedfb1aa7f52cd55e86e0022ab4ec5e8392d764b574a884d115ef5
SSDEEP

3072:XVR2y9+DulIevNL5lOj4pVNb0HSSSGVJtlhOOr:D2yZldvN91rb0ySZce

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  3afc1e842a76f2cecb20f395dfa71630_JaffaCakes118
- Size
  
  148KB
- MD5
  
  3afc1e842a76f2cecb20f395dfa71630
- SHA1
  
  8edd1247ceda6aa51100b5b2f9d98eeee8ff8e8e
- SHA256
  
  440c90dcf04b3314204ec4b3f2c3418c7ffb0547143500134e3a5ea379525fc1
- SHA512
  
  d3fb4424e8686b4aeb2162936359cb4256d25420e60a51d7b4ea1a6c41614096ff9b7efac4bedfb1aa7f52cd55e86e0022ab4ec5e8392d764b574a884d115ef5
- SSDEEP
  
  3072:XVR2y9+DulIevNL5lOj4pVNb0HSSSGVJtlhOOr:D2yZldvN91rb0ySZce
Score

7^/10

discovery persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2