6fbdaa6d5e497f78db70beec806e70ed82ff78c383edea45b7d56f10d3b5a1c6 | Triage

Sharing

General

Target

c2416aec2747f03a912b07f0b7aa069a_JaffaCakes118
Size

281KB
Sample

240826-eradtswaqp
MD5

c2416aec2747f03a912b07f0b7aa069a
SHA1

251ff482ec6470b0d69a70667fcc51a117bcc67b
SHA256

6fbdaa6d5e497f78db70beec806e70ed82ff78c383edea45b7d56f10d3b5a1c6
SHA512

1dc4c469220797b78d4c75993d183a16270ab3b575415dd75f56dad6b9401a7d108a5fc3fc1b2d30f5deadf52196c4121b44a1708587320d4ad76959e924e91f
SSDEEP

6144:7pcnH1hymlUEAsvK7ke5L3iFPwsj9CnL9R6jbKVCA7W5f1uHVOJ:7pYDycUEAWK7SCsj9kLnCAS9IVW

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  c2416aec2747f03a912b07f0b7aa069a_JaffaCakes118
- Size
  
  281KB
- MD5
  
  c2416aec2747f03a912b07f0b7aa069a
- SHA1
  
  251ff482ec6470b0d69a70667fcc51a117bcc67b
- SHA256
  
  6fbdaa6d5e497f78db70beec806e70ed82ff78c383edea45b7d56f10d3b5a1c6
- SHA512
  
  1dc4c469220797b78d4c75993d183a16270ab3b575415dd75f56dad6b9401a7d108a5fc3fc1b2d30f5deadf52196c4121b44a1708587320d4ad76959e924e91f
- SSDEEP
  
  6144:7pcnH1hymlUEAsvK7ke5L3iFPwsj9CnL9R6jbKVCA7W5f1uHVOJ:7pYDycUEAWK7SCsj9kLnCAS9IVW
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Adds Run key to start application
  persistence
- Modifies WinLogon
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence