e189fb63b73b753b07c464f93a2ce2cdd55b93c0f678b5f1c85edb486c4cd02f | Triage

Sharing

General

Target

d5849dfe11450640efd7a6f78141dc76_JaffaCakes118
Size

387KB
Sample

240909-czqdxazeqe
MD5

d5849dfe11450640efd7a6f78141dc76
SHA1

4937560a144a57aec86cc82dce65c49d8eaf52d9
SHA256

e189fb63b73b753b07c464f93a2ce2cdd55b93c0f678b5f1c85edb486c4cd02f
SHA512

d2f798c690b7e1276463e4413164a461c4f427e1e7b844604809df385fbd3d192e602ed052ef28437586586e3792a4b5651a4882dbd966ea13ce7b0c03326941
SSDEEP

6144:anSxOhzm7DMSB2qdDqBMYY16qXKATBSPsV2zBu/RlQiwM0i:aSxOhzmXVXqBMYY1zTs7kZuiwM0

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  d5849dfe11450640efd7a6f78141dc76_JaffaCakes118
- Size
  
  387KB
- MD5
  
  d5849dfe11450640efd7a6f78141dc76
- SHA1
  
  4937560a144a57aec86cc82dce65c49d8eaf52d9
- SHA256
  
  e189fb63b73b753b07c464f93a2ce2cdd55b93c0f678b5f1c85edb486c4cd02f
- SHA512
  
  d2f798c690b7e1276463e4413164a461c4f427e1e7b844604809df385fbd3d192e602ed052ef28437586586e3792a4b5651a4882dbd966ea13ce7b0c03326941
- SSDEEP
  
  6144:anSxOhzm7DMSB2qdDqBMYY16qXKATBSPsV2zBu/RlQiwM0i:aSxOhzmXVXqBMYY1zTs7kZuiwM0
Score

10^/10

discovery evasion persistence
- Modifies security service
  evasion
- Loads dropped DLL
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoverypersistence