812393c0a782bd688192a8a2558d48c79cf3ab5b568414817ac19c8c8336919d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

45f535c3146383fb915b6464a2897297_JaffaCakes118
Size

266KB
Sample

240714-qed22a1glq
MD5

45f535c3146383fb915b6464a2897297
SHA1

6fe30f6a2e0ef5073ab8cd28894bd250af2a4bcd
SHA256

812393c0a782bd688192a8a2558d48c79cf3ab5b568414817ac19c8c8336919d
SHA512

8dd5d4a17ee1021d25ffbb0abd98e7a5250c44a50c2ffec6b8f0a371c0bf84bce2f11412c9e78082b867cfc63c1b2c092525678b394716145de75c3d55e0d8d8
SSDEEP

3072:NW/1lqNqAoPJl+Q7fFOPLfie9rHbK5pWsl8bnDZNnZRfs6pCWtKU7xTVKpfo5Utn:grDPSgFCqiXIQ28bDr5trKpfo5aoo

Score

10^/10

persistence upx

Malware Config

Targets

- Target
  
  45f535c3146383fb915b6464a2897297_JaffaCakes118
- Size
  
  266KB
- MD5
  
  45f535c3146383fb915b6464a2897297
- SHA1
  
  6fe30f6a2e0ef5073ab8cd28894bd250af2a4bcd
- SHA256
  
  812393c0a782bd688192a8a2558d48c79cf3ab5b568414817ac19c8c8336919d
- SHA512
  
  8dd5d4a17ee1021d25ffbb0abd98e7a5250c44a50c2ffec6b8f0a371c0bf84bce2f11412c9e78082b867cfc63c1b2c092525678b394716145de75c3d55e0d8d8
- SSDEEP
  
  3072:NW/1lqNqAoPJl+Q7fFOPLfie9rHbK5pWsl8bnDZNnZRfs6pCWtKU7xTVKpfo5Utn:grDPSgFCqiXIQ28bDr5trKpfo5aoo
Score

10^/10

persistence
- Modifies WinLogon for persistence
  persistence
- Adds Run key to start application
  persistence
- Modifies WinLogon
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2