b239b13e25a118d626fb75fd228052a4c6232eeeb1e0bc6887b350fda97cca66 | Triage

Sharing

General

Target

d25244325b9bc5ed64196d6f9241064f_JaffaCakes118
Size

142KB
Sample

240907-tkm4nssbkj
MD5

d25244325b9bc5ed64196d6f9241064f
SHA1

36cb6ee0e1bfae0ced42a02a8eaf120aaa1d83e9
SHA256

b239b13e25a118d626fb75fd228052a4c6232eeeb1e0bc6887b350fda97cca66
SHA512

d16ade6838f1f0b925e045019870f4bf606dc175cd611713479075023400ca90f2bc3684c0e4d07f686c1b1a74edefd7374f12a8b2fef970bf6949a39f83d57c
SSDEEP

3072:FUXi7Z2gcsRxAftxlre7hcEIdGPzdAfJbdT5c:FUXWZ2gcoyt2qwdARc

Score

10^/10

defense_evasion discovery evasion persistence

Malware Config

Targets

- Target
  
  d25244325b9bc5ed64196d6f9241064f_JaffaCakes118
- Size
  
  142KB
- MD5
  
  d25244325b9bc5ed64196d6f9241064f
- SHA1
  
  36cb6ee0e1bfae0ced42a02a8eaf120aaa1d83e9
- SHA256
  
  b239b13e25a118d626fb75fd228052a4c6232eeeb1e0bc6887b350fda97cca66
- SHA512
  
  d16ade6838f1f0b925e045019870f4bf606dc175cd611713479075023400ca90f2bc3684c0e4d07f686c1b1a74edefd7374f12a8b2fef970bf6949a39f83d57c
- SSDEEP
  
  3072:FUXi7Z2gcsRxAftxlre7hcEIdGPzdAfJbdT5c:FUXWZ2gcoyt2qwdARc
Score

10^/10

defense_evasion discovery evasion persistence
- Modifies WinLogon for persistence
  persistence
- Disables Task Manager via registry modification
  evasion
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Modifies WinLogon
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Safe Mode Boot

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionpersistence

behavioral2

defense_evasiondiscoveryevasionpersistence