e487fd4405c4a174c5f9bbd89b7c95ad16948e9762646b3e5c625f8712d3878d | Triage

Sharing

General

Target

a17b95bc7dc6eb870a735f9b05990def_JaffaCakes118
Size

245KB
Sample

240817-g1ljka1drf
MD5

a17b95bc7dc6eb870a735f9b05990def
SHA1

68463fd55aa9b7a7977c5e9281bc537ff88e67fe
SHA256

e487fd4405c4a174c5f9bbd89b7c95ad16948e9762646b3e5c625f8712d3878d
SHA512

787d9585969136bcf35a00098c2086191a45cccb02d0170437119a104525037ec9fc76745c562a779e62bfc4ab22979ea6bf7ede56164ceeb9842151743e1975
SSDEEP

6144:/VtMbjk4c/T0KJ8I1y507VY/eQ3AxaXDIutfY0://KjkRtqI1Y07VY/zQ8htA0

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  a17b95bc7dc6eb870a735f9b05990def_JaffaCakes118
- Size
  
  245KB
- MD5
  
  a17b95bc7dc6eb870a735f9b05990def
- SHA1
  
  68463fd55aa9b7a7977c5e9281bc537ff88e67fe
- SHA256
  
  e487fd4405c4a174c5f9bbd89b7c95ad16948e9762646b3e5c625f8712d3878d
- SHA512
  
  787d9585969136bcf35a00098c2086191a45cccb02d0170437119a104525037ec9fc76745c562a779e62bfc4ab22979ea6bf7ede56164ceeb9842151743e1975
- SSDEEP
  
  6144:/VtMbjk4c/T0KJ8I1y507VY/eQ3AxaXDIutfY0://KjkRtqI1Y07VY/zQ8htA0
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Adds Run key to start application
  persistence
- Modifies WinLogon
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence