291b78b0ff6b054edfdd4c468fb23008c4a5026b87a4d890242ad41873f234f4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

df7234eb52197a820044991f577a78c6_JaffaCakes118
Size

316KB
Sample

240914-ehjk5swelg
MD5

df7234eb52197a820044991f577a78c6
SHA1

eb423ad903febc9f559879bd3103d15df0b963cd
SHA256

291b78b0ff6b054edfdd4c468fb23008c4a5026b87a4d890242ad41873f234f4
SHA512

a2a1e8a602b95f484f1a491c44b3b30710db9f3cef4ddd952d58be69af291bc5e6636193627dc443ab9cddb758b64aaca94dd226e1dd02ab1c39e36c9233aa32
SSDEEP

6144:HrMzOA4mI7onX+abS7s2W22YuMYAmi17uutzJuj3xtbpFjBVHhv:HrM4mI4OabNj28MrZNv/EJBdR

Score

5^/10

discovery persistence privilege_escalation

Malware Config

Targets

- Target
  
  df7234eb52197a820044991f577a78c6_JaffaCakes118
- Size
  
  316KB
- MD5
  
  df7234eb52197a820044991f577a78c6
- SHA1
  
  eb423ad903febc9f559879bd3103d15df0b963cd
- SHA256
  
  291b78b0ff6b054edfdd4c468fb23008c4a5026b87a4d890242ad41873f234f4
- SHA512
  
  a2a1e8a602b95f484f1a491c44b3b30710db9f3cef4ddd952d58be69af291bc5e6636193627dc443ab9cddb758b64aaca94dd226e1dd02ab1c39e36c9233aa32
- SSDEEP
  
  6144:HrMzOA4mI7onX+abS7s2W22YuMYAmi17uutzJuj3xtbpFjBVHhv:HrM4mI4OabNj28MrZNv/EJBdR
Score

5^/10

discovery persistence privilege_escalation
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Authentication Package

Privilege Escalation

Boot or Logon Autostart Execution

Authentication Package

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoverypersistenceprivilege_escalation