b97a63704dee1e3b2f6ed3b5e40da5c04ad4b348befd0d0cbc07352ce967cec7 | Triage

Sharing

General

Target

8532645f400e945235d56569b92a6317_JaffaCakes118
Size

25KB
Sample

240810-hteccathme
MD5

8532645f400e945235d56569b92a6317
SHA1

2c41549f86353625695c87efc6725f77db78d4cf
SHA256

b97a63704dee1e3b2f6ed3b5e40da5c04ad4b348befd0d0cbc07352ce967cec7
SHA512

49c48488449ce58e97543759d049c9a09cce0dc467ab4421412d2c90496e28d543f14fad4c32a5df47cfd579e48d870ae4c0d36278adf5e66b4a9fa15b976cb5
SSDEEP

768:oKcoCN1+bTlec2ot7lmGehnQ/iBQZLqr:RcbN1+Vf2ovmG0ngi0g

Score

10^/10

discovery persistence upx

Malware Config

Targets

- Target
  
  8532645f400e945235d56569b92a6317_JaffaCakes118
- Size
  
  25KB
- MD5
  
  8532645f400e945235d56569b92a6317
- SHA1
  
  2c41549f86353625695c87efc6725f77db78d4cf
- SHA256
  
  b97a63704dee1e3b2f6ed3b5e40da5c04ad4b348befd0d0cbc07352ce967cec7
- SHA512
  
  49c48488449ce58e97543759d049c9a09cce0dc467ab4421412d2c90496e28d543f14fad4c32a5df47cfd579e48d870ae4c0d36278adf5e66b4a9fa15b976cb5
- SSDEEP
  
  768:oKcoCN1+bTlec2ot7lmGehnQ/iBQZLqr:RcbN1+Vf2ovmG0ngi0g
Score

10^/10

discovery persistence upx
- Modifies WinLogon for persistence
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistenceupx

behavioral2