0fcc8ec62ab1ce7c7f7835da76eeb6a16554c3243dfeb760cbe72f4cef634015 | Triage

Sharing

General

Target

6eed3bb731d7fafc6564a82d36e7d4f7_JaffaCakes118
Size

30KB
Sample

240725-kymwdszcjq
MD5

6eed3bb731d7fafc6564a82d36e7d4f7
SHA1

94c4829454760bc7a84c3d1caec9c2a3c363554b
SHA256

0fcc8ec62ab1ce7c7f7835da76eeb6a16554c3243dfeb760cbe72f4cef634015
SHA512

76d0e33200799807593cb9bf803fbedd6d4ef765cbe19a12048f5f5472edff0f2fc6286435b73f5a6d0da21c0b9c19788668c3caf24bb6cce0d0c49fdabc264b
SSDEEP

768:o9wUMrsubOJVj4TYHVjSvht8eFGUMo74e3qs134moEilu0:okOJVj4TYAGUB4F23Pp

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  6eed3bb731d7fafc6564a82d36e7d4f7_JaffaCakes118
- Size
  
  30KB
- MD5
  
  6eed3bb731d7fafc6564a82d36e7d4f7
- SHA1
  
  94c4829454760bc7a84c3d1caec9c2a3c363554b
- SHA256
  
  0fcc8ec62ab1ce7c7f7835da76eeb6a16554c3243dfeb760cbe72f4cef634015
- SHA512
  
  76d0e33200799807593cb9bf803fbedd6d4ef765cbe19a12048f5f5472edff0f2fc6286435b73f5a6d0da21c0b9c19788668c3caf24bb6cce0d0c49fdabc264b
- SSDEEP
  
  768:o9wUMrsubOJVj4TYHVjSvht8eFGUMo74e3qs134moEilu0:okOJVj4TYAGUB4F23Pp
Score

10^/10

persistence discovery
- Modifies WinLogon for persistence
  persistence
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Modifies WinLogon
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoverypersistence