97d0d6b63d10ec126995275b0ce95165bb4203d61745b726cb96ba376fd3e091 | Triage

Sharing

General

Target

d015e3cb2a5bf11f52b39f6729eb28c6_JaffaCakes118
Size

314KB
Sample

240906-v5ehpsyhjm
MD5

d015e3cb2a5bf11f52b39f6729eb28c6
SHA1

9f4b79dca82f0652435569ed4899d3a940392f4a
SHA256

97d0d6b63d10ec126995275b0ce95165bb4203d61745b726cb96ba376fd3e091
SHA512

db1b8784c02ace8512d20b1410ad6d01661b3b67079b99e816a1cae5ccd891dddef5bc74f6ef73c41570a7bd349378dbcdebd84ff8518ef1d9eb4c5b0ac1976a
SSDEEP

6144:rfHvvR4aGidv9kugqQwPTvN/hdRq/FfPG3m+OKRB98ukDOC1w5:jHn6wdv9kGQETvNZqBP/H6K3Ddw5

Score

5^/10

discovery persistence privilege_escalation

Malware Config

Targets

- Target
  
  d015e3cb2a5bf11f52b39f6729eb28c6_JaffaCakes118
- Size
  
  314KB
- MD5
  
  d015e3cb2a5bf11f52b39f6729eb28c6
- SHA1
  
  9f4b79dca82f0652435569ed4899d3a940392f4a
- SHA256
  
  97d0d6b63d10ec126995275b0ce95165bb4203d61745b726cb96ba376fd3e091
- SHA512
  
  db1b8784c02ace8512d20b1410ad6d01661b3b67079b99e816a1cae5ccd891dddef5bc74f6ef73c41570a7bd349378dbcdebd84ff8518ef1d9eb4c5b0ac1976a
- SSDEEP
  
  6144:rfHvvR4aGidv9kugqQwPTvN/hdRq/FfPG3m+OKRB98ukDOC1w5:jHn6wdv9kGQETvNZqBP/H6K3Ddw5
Score

5^/10

discovery persistence privilege_escalation
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Authentication Package

Privilege Escalation

Boot or Logon Autostart Execution

Authentication Package

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoverypersistenceprivilege_escalation