7a43d484dd93a0bcc6039dd22efc50339d1aa2c5ff1ea0cae829b3c842fca190 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bd2828a12b7f4001c29ce5c41a65de6a_JaffaCakes118
Size

493KB
Sample

240823-zxs4caydqq
MD5

bd2828a12b7f4001c29ce5c41a65de6a
SHA1

12406befc918e36fa624c505ee9445009d59d4d2
SHA256

7a43d484dd93a0bcc6039dd22efc50339d1aa2c5ff1ea0cae829b3c842fca190
SHA512

3713642221a9e6b608c016ec49f65ce29c48e754539e1e6db8506b0364e1f00ae20fea46fe6705c4c1db7f11c162cbd4c84fc200e49f3b00cd2a1dfec9cf4ce1
SSDEEP

3072:ml1QuMzkJDPy/Pgw0JOnqyeJkZEb3/Pgw0JOnqye:ml1BYEP2a+ZEpa

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  bd2828a12b7f4001c29ce5c41a65de6a_JaffaCakes118
- Size
  
  493KB
- MD5
  
  bd2828a12b7f4001c29ce5c41a65de6a
- SHA1
  
  12406befc918e36fa624c505ee9445009d59d4d2
- SHA256
  
  7a43d484dd93a0bcc6039dd22efc50339d1aa2c5ff1ea0cae829b3c842fca190
- SHA512
  
  3713642221a9e6b608c016ec49f65ce29c48e754539e1e6db8506b0364e1f00ae20fea46fe6705c4c1db7f11c162cbd4c84fc200e49f3b00cd2a1dfec9cf4ce1
- SSDEEP
  
  3072:ml1QuMzkJDPy/Pgw0JOnqyeJkZEb3/Pgw0JOnqye:ml1BYEP2a+ZEpa
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Event Triggered Execution: Image File Execution Options Injection
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2