99ca075d02ae5e665ba87a5bd1bb57b84cdcbafce5a0abae93fcb678c489ee96 | Triage

Sharing

General

Target

8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118
Size

640KB
Sample

240812-c4vjes1fml
MD5

8cfc835eb0c76cd156dd77b938b15055
SHA1

b706fb637008ab7345583113d79c4d3f27dcda32
SHA256

99ca075d02ae5e665ba87a5bd1bb57b84cdcbafce5a0abae93fcb678c489ee96
SHA512

66fb749f43d6f4b8d50db45f498012f8a7dbbd0bf995ee2f3c89487b40acfb9a9f00eced7e979fe9977ce6ee5f49f0775f745079d6be1fb2e9d72eb84696c97e
SSDEEP

12288:K2t+p51LpsGLLFjHfS9yZPoOKAgA3S5Fl0m0pcGieSzzQE6p:KiW5Ds2LVjgOjI3HpGFSf

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118
- Size
  
  640KB
- MD5
  
  8cfc835eb0c76cd156dd77b938b15055
- SHA1
  
  b706fb637008ab7345583113d79c4d3f27dcda32
- SHA256
  
  99ca075d02ae5e665ba87a5bd1bb57b84cdcbafce5a0abae93fcb678c489ee96
- SHA512
  
  66fb749f43d6f4b8d50db45f498012f8a7dbbd0bf995ee2f3c89487b40acfb9a9f00eced7e979fe9977ce6ee5f49f0775f745079d6be1fb2e9d72eb84696c97e
- SSDEEP
  
  12288:K2t+p51LpsGLLFjHfS9yZPoOKAgA3S5Fl0m0pcGieSzzQE6p:KiW5Ds2LVjgOjI3HpGFSf
Score

10^/10

discovery evasion persistence
- Modifies WinLogon for persistence
  persistence
- Disables Task Manager via registry modification
  evasion
- Adds Run key to start application
  persistence
- Modifies WinLogon
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence