kronos | 9b5ce6709918eb68c83c2c6fb188770852f0ee4463531d65d175ce9100bc1342 | Triage™

Login
Reports

Overview

overview

Static

static

3

92f4179366...18.exe

windows7-x64

92f4179366...18.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target
92f41793668b39e40b15e613178ef72e_JaffaCakes118
Size 276KB
Sample240603-3axd2acf9y
SHA256 9b5ce6709918eb68c83c2c6fb188770852f0ee4463531d65d175ce9100bc1342
MD5 92f41793668b39e40b15e613178ef72e
SHA1 c8830e3fd414ca3c96417b19317bbc29baee7813
SHA512 36faeabc755ef89a0594d3569142c9663f7351801f624b5ffebc9b9c7922afd3b5857eac8b7ef53a163bcd19743754ff019135bac00d25b904b2dbcaf7d26491
SSDEEP 6144:EaOh5fUVLxZzDJ6sikTBqKCEudJldVynNHbh/2z3+zTLWAQwv5lmYLrDKLrD6Kl:LOh5fELvDJ6sfTsKCEAzIVKlvrTpFOWK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kronos banker botnet evasion persistence

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

92f41793668b39e40b15e613178ef72e_JaffaCakes118.exe

Resource

win7-20240215-en

windows7-x64

11 signatures

150 seconds

kronos banker botnet evasion persistence

Behavioral task

behavioral2

Sample

92f41793668b39e40b15e613178ef72e_JaffaCakes118.exe

Resource

win10v2004-20240426-en

windows10-2004-x64

6 signatures

150 seconds

kronos banker botnet persistence

Malware Config

Targets

- Target
  92f41793668b39e40b15e613178ef72e_JaffaCakes118
- Size 276KB
- SHA256 9b5ce6709918eb68c83c2c6fb188770852f0ee4463531d65d175ce9100bc1342
- MD5 92f41793668b39e40b15e613178ef72e
- SHA1 c8830e3fd414ca3c96417b19317bbc29baee7813
- SHA512 36faeabc755ef89a0594d3569142c9663f7351801f624b5ffebc9b9c7922afd3b5857eac8b7ef53a163bcd19743754ff019135bac00d25b904b2dbcaf7d26491
- SSDEEP 6144:EaOh5fUVLxZzDJ6sikTBqKCEudJldVynNHbh/2z3+zTLWAQwv5lmYLrDKLrD6Kl:LOh5fELvDJ6sfTsKCEAzIVKlvrTpFOWK
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

kronos banker botnet evasion persistence
- Kronos
  banker botnet kronos
- Modifies security service
  evasion
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

kronosbankerbotnetevasionpersistence

behavioral2

kronosbankerbotnetpersistence

© 2018-2026

Terms | Privacy