6b58e0a021bf4e2ab87aec4e40b3415ee313d7d1d24be6d413334ec6f4ff0c26 | Triage

Sharing

General

Target

95e76c242eadbaf1d75503d46482c8ca_JaffaCakes118
Size

89KB
Sample

240814-njrskszbkd
MD5

95e76c242eadbaf1d75503d46482c8ca
SHA1

d85e6e881ef477ea6111c85d80a5e2af8986cbbd
SHA256

6b58e0a021bf4e2ab87aec4e40b3415ee313d7d1d24be6d413334ec6f4ff0c26
SHA512

1bbd5cd879f2db2cd8414035996f04327e931ca65e0b127de0c553e2c0a25aacb3041eaac2a6103592d8a9d3c0744bd00283c75af765e274f92b620cffabe9ad
SSDEEP

768:MrFPx8ceViHNaZyiJHFlnjSSO3c1boD9d9rA49U6n1hPLJ890GMkJ5z9o6je4K6m:MByKNaZXWYEi4K6nPMbLRoMe4KBd

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  95e76c242eadbaf1d75503d46482c8ca_JaffaCakes118
- Size
  
  89KB
- MD5
  
  95e76c242eadbaf1d75503d46482c8ca
- SHA1
  
  d85e6e881ef477ea6111c85d80a5e2af8986cbbd
- SHA256
  
  6b58e0a021bf4e2ab87aec4e40b3415ee313d7d1d24be6d413334ec6f4ff0c26
- SHA512
  
  1bbd5cd879f2db2cd8414035996f04327e931ca65e0b127de0c553e2c0a25aacb3041eaac2a6103592d8a9d3c0744bd00283c75af765e274f92b620cffabe9ad
- SSDEEP
  
  768:MrFPx8ceViHNaZyiJHFlnjSSO3c1boD9d9rA49U6n1hPLJ890GMkJ5z9o6je4K6m:MByKNaZXWYEi4K6nPMbLRoMe4KBd
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence