Overview

overview

10

Static

static

3

0320ad1e81...18.exe

windows7-x64

10

0320ad1e81...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0320ad1e81aafdabb332aed59ff0d239_JaffaCakes118

  • Size

    502KB

  • Sample

    240427-nbzs8ahc82

  • MD5

    0320ad1e81aafdabb332aed59ff0d239

  • SHA1

    dc5955bbaff927879b8e40867930613819332f1f

  • SHA256

    8ac03a003166b40278c8f325916b5516769621e3b6faf16d0c0a936cdadcd3f7

  • SHA512

    d85dc110e2dbd091f6f598cf624edff0d42071495565a1b9ae5bc6fbbb42c3efdbb9bf564cbac869c4f3ea1afd684af785d63a52868382c7029df600c8f2ccda

  • SSDEEP

    12288:I1bGKflmTPk1JN0awXEK9+GfqBSVhiXirQhb2Z4Y:I1bG2UPk1QafKJvDDQU

Score
10/10
persistence

Malware Config

Targets

    • Target

      0320ad1e81aafdabb332aed59ff0d239_JaffaCakes118

    • Size

      502KB

    • MD5

      0320ad1e81aafdabb332aed59ff0d239

    • SHA1

      dc5955bbaff927879b8e40867930613819332f1f

    • SHA256

      8ac03a003166b40278c8f325916b5516769621e3b6faf16d0c0a936cdadcd3f7

    • SHA512

      d85dc110e2dbd091f6f598cf624edff0d42071495565a1b9ae5bc6fbbb42c3efdbb9bf564cbac869c4f3ea1afd684af785d63a52868382c7029df600c8f2ccda

    • SSDEEP

      12288:I1bGKflmTPk1JN0awXEK9+GfqBSVhiXirQhb2Z4Y:I1bG2UPk1QafKJvDDQU

    Score
    10/10
    persistence

    • Modifies WinLogon for persistence

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks