13894d0a49af6483baf3fd2cf72e43cd18f7823b5ed42fd36df7c655fe579b28 | Triage

Sharing

General

Target

8c528b50796053319916cc3758f7d3f1_JaffaCakes118
Size

253KB
Sample

240811-2yc5matajr
MD5

8c528b50796053319916cc3758f7d3f1
SHA1

0bb99b6b280616a490648606dcba4f0ce6b16fcf
SHA256

13894d0a49af6483baf3fd2cf72e43cd18f7823b5ed42fd36df7c655fe579b28
SHA512

e0171b625a02b0c0351c62a016398fd5df2f39fc931e31e239905aa759951c4785610c219f932b10bd40c5fe8a4ef8e7a5592d11273954755322541e9ccf3760
SSDEEP

6144:53UaFS58Q+Sij0nVGtnQfNmPvwQ5rQidwByQotV:535E2FjTnOCIQ5rn3QoP

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  8c528b50796053319916cc3758f7d3f1_JaffaCakes118
- Size
  
  253KB
- MD5
  
  8c528b50796053319916cc3758f7d3f1
- SHA1
  
  0bb99b6b280616a490648606dcba4f0ce6b16fcf
- SHA256
  
  13894d0a49af6483baf3fd2cf72e43cd18f7823b5ed42fd36df7c655fe579b28
- SHA512
  
  e0171b625a02b0c0351c62a016398fd5df2f39fc931e31e239905aa759951c4785610c219f932b10bd40c5fe8a4ef8e7a5592d11273954755322541e9ccf3760
- SSDEEP
  
  6144:53UaFS58Q+Sij0nVGtnQfNmPvwQ5rQidwByQotV:535E2FjTnOCIQ5rn3QoP
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Adds Run key to start application
  persistence
- Modifies WinLogon
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence