a9fd6ec48f9951043fb07f2a1a8999452d1ecff564e91a67d6d0ee122b97163b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4b0c0f3b145c47577afe2a4f00ab38b3_JaffaCakes118
Size

255KB
Sample

240715-xyzamsvfnm
MD5

4b0c0f3b145c47577afe2a4f00ab38b3
SHA1

29d075d0c7eb43e4454fc0542ca2a95bd2495856
SHA256

a9fd6ec48f9951043fb07f2a1a8999452d1ecff564e91a67d6d0ee122b97163b
SHA512

f9345ffaca67da0af1c9186fd0de8df06ecd6fc94e8defdbd780242bcecb998bbaad1d75604f05fef8c1897434f8b255ea0daa487f98acd5012c2f0da9830fd8
SSDEEP

6144:ONU2+2kcTBWUZxjCld3hRV2QsXSAaj4ijpFaQTQisa:ONRdpgdRRoTCD4ijpoix

Score

10^/10

persistence

Malware Config

Targets

- Target
  
  4b0c0f3b145c47577afe2a4f00ab38b3_JaffaCakes118
- Size
  
  255KB
- MD5
  
  4b0c0f3b145c47577afe2a4f00ab38b3
- SHA1
  
  29d075d0c7eb43e4454fc0542ca2a95bd2495856
- SHA256
  
  a9fd6ec48f9951043fb07f2a1a8999452d1ecff564e91a67d6d0ee122b97163b
- SHA512
  
  f9345ffaca67da0af1c9186fd0de8df06ecd6fc94e8defdbd780242bcecb998bbaad1d75604f05fef8c1897434f8b255ea0daa487f98acd5012c2f0da9830fd8
- SSDEEP
  
  6144:ONU2+2kcTBWUZxjCld3hRV2QsXSAaj4ijpFaQTQisa:ONRdpgdRRoTCD4ijpoix
Score

10^/10

persistence
- Modifies WinLogon for persistence
  persistence
- Adds Run key to start application
  persistence
- Modifies WinLogon
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2