5db409f6d26e91ff0b3f8cc570f31f6d19b4fc302ab5902166839bfd842d5492 | Triage

Sharing

General

Target

78ec40d752bd5c80b6a2cb5c22e8ba2c_JaffaCakes118
Size

283KB
Sample

240727-vs55wstana
MD5

78ec40d752bd5c80b6a2cb5c22e8ba2c
SHA1

bab6222ba672e1c1d27691b69731b265ff8f48b9
SHA256

5db409f6d26e91ff0b3f8cc570f31f6d19b4fc302ab5902166839bfd842d5492
SHA512

551e2e72bba8caa8079be7e1abff8bb1c71f0b7c126c83abf307f8173caac72d647a27f0e47b36565d34f34f59c60b65edf85c14727d8ba026a16eb49c72fc97
SSDEEP

6144:e9l9vjx3MtZ4KrllCHN2pBhWE6kdisuL2r55W1rda2:e1vjxUoApBhn+2vaP

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  78ec40d752bd5c80b6a2cb5c22e8ba2c_JaffaCakes118
- Size
  
  283KB
- MD5
  
  78ec40d752bd5c80b6a2cb5c22e8ba2c
- SHA1
  
  bab6222ba672e1c1d27691b69731b265ff8f48b9
- SHA256
  
  5db409f6d26e91ff0b3f8cc570f31f6d19b4fc302ab5902166839bfd842d5492
- SHA512
  
  551e2e72bba8caa8079be7e1abff8bb1c71f0b7c126c83abf307f8173caac72d647a27f0e47b36565d34f34f59c60b65edf85c14727d8ba026a16eb49c72fc97
- SSDEEP
  
  6144:e9l9vjx3MtZ4KrllCHN2pBhWE6kdisuL2r55W1rda2:e1vjxUoApBhn+2vaP
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2