3b04e49490253e9a35be1838b75f5e8a11bc47025fe847b126aa8a8c98c9cdd9 | Triage

Sharing

General

Target

83c5e9ebb50625691e160e92f8c8f244_JaffaCakes118
Size

211KB
Sample

240809-19ks6swejb
MD5

83c5e9ebb50625691e160e92f8c8f244
SHA1

215df42eb95f52c9e7586fae1064552519f2c900
SHA256

3b04e49490253e9a35be1838b75f5e8a11bc47025fe847b126aa8a8c98c9cdd9
SHA512

0f28e3460589d9ce55f5dfb74db069a178f9c1005de8d9155f7b572961c7d8bb8f9107a9d282314ee366d07b0c61d9d917f966cec8b418b6f785a711713a5ac6
SSDEEP

768:NikxN1wLPr4rS518RxcW1J7XTC05GKJZQaHu7J4of1zBmQzTGfmgyqU:wkxN1wH4uHUD1V5pZQ64Zf1zwQVgvU

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  83c5e9ebb50625691e160e92f8c8f244_JaffaCakes118
- Size
  
  211KB
- MD5
  
  83c5e9ebb50625691e160e92f8c8f244
- SHA1
  
  215df42eb95f52c9e7586fae1064552519f2c900
- SHA256
  
  3b04e49490253e9a35be1838b75f5e8a11bc47025fe847b126aa8a8c98c9cdd9
- SHA512
  
  0f28e3460589d9ce55f5dfb74db069a178f9c1005de8d9155f7b572961c7d8bb8f9107a9d282314ee366d07b0c61d9d917f966cec8b418b6f785a711713a5ac6
- SSDEEP
  
  768:NikxN1wLPr4rS518RxcW1J7XTC05GKJZQaHu7J4of1zBmQzTGfmgyqU:wkxN1wH4uHUD1V5pZQ64Zf1zwQVgvU
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence