81ff00bc5eeab0229bb0e63ae2061f599f088fa9e884effb840a1832b9c3229d | Triage

Sharing

General

Target

a12e1fb7625b0de3a6aa13eb5c959c36_JaffaCakes118
Size

335KB
Sample

240817-eyaceaxapa
MD5

a12e1fb7625b0de3a6aa13eb5c959c36
SHA1

db47bfc4348caa7a8775a269a70b97b8429debc3
SHA256

81ff00bc5eeab0229bb0e63ae2061f599f088fa9e884effb840a1832b9c3229d
SHA512

0e1b55893781466a82a20f18f5db1cb17886db04041d611435c564f58468f6abc90926350069ca11ad5759bdc3ac5bba052d038912525725f12a4e7474543f06
SSDEEP

6144:9e3nx3oWmDg2djppvLdqRsPuQesxKVprEOQVABkymjgmnGAVff0M:Ux3oWPMVNouPysAur6ZmHnNf0M

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  a12e1fb7625b0de3a6aa13eb5c959c36_JaffaCakes118
- Size
  
  335KB
- MD5
  
  a12e1fb7625b0de3a6aa13eb5c959c36
- SHA1
  
  db47bfc4348caa7a8775a269a70b97b8429debc3
- SHA256
  
  81ff00bc5eeab0229bb0e63ae2061f599f088fa9e884effb840a1832b9c3229d
- SHA512
  
  0e1b55893781466a82a20f18f5db1cb17886db04041d611435c564f58468f6abc90926350069ca11ad5759bdc3ac5bba052d038912525725f12a4e7474543f06
- SSDEEP
  
  6144:9e3nx3oWmDg2djppvLdqRsPuQesxKVprEOQVABkymjgmnGAVff0M:Ux3oWPMVNouPysAur6ZmHnNf0M
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2