d5b3a860c43ec5fc357ff7bfe3b8cecfa800f4f22f4c46bbb20d2abfcfd5eb4e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8b911ec98de3770d49daed7581325733_JaffaCakes118
Size

243KB
Sample

240811-xh5gqaxbpc
MD5

8b911ec98de3770d49daed7581325733
SHA1

112bd016c0e683638cccccc2336ef2d0db46cbc8
SHA256

d5b3a860c43ec5fc357ff7bfe3b8cecfa800f4f22f4c46bbb20d2abfcfd5eb4e
SHA512

371743dd1ceb0cec9b723980937498f97c34e32a9fa90e4927f442abbe744d276352b26f0a3987db309be62401e78b16df0ffe0203645d9cb5b478b55b806564
SSDEEP

6144:kvoMvtQYA99LIxGtp7gZQ+4CcxYc/ZwyUiYQw4dAN9inWTY+otHbyYuZkqQm:kvoMvtQYA9KxGtGW2cBRUmd8onWM+2kH

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  8b911ec98de3770d49daed7581325733_JaffaCakes118
- Size
  
  243KB
- MD5
  
  8b911ec98de3770d49daed7581325733
- SHA1
  
  112bd016c0e683638cccccc2336ef2d0db46cbc8
- SHA256
  
  d5b3a860c43ec5fc357ff7bfe3b8cecfa800f4f22f4c46bbb20d2abfcfd5eb4e
- SHA512
  
  371743dd1ceb0cec9b723980937498f97c34e32a9fa90e4927f442abbe744d276352b26f0a3987db309be62401e78b16df0ffe0203645d9cb5b478b55b806564
- SSDEEP
  
  6144:kvoMvtQYA99LIxGtp7gZQ+4CcxYc/ZwyUiYQw4dAN9inWTY+otHbyYuZkqQm:kvoMvtQYA9KxGtGW2cBRUmd8onWM+2kH
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Adds Run key to start application
  persistence
- Modifies WinLogon
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence