9cb327ce759be960e3ba338e7e28cbbd9a2ce4f7f009e36e46ce20ee6e626d9e | Triage

Sharing

General

Target

e25c0b966dcade61c857fd9ad7d88acb_JaffaCakes118
Size

1.4MB
Sample

240915-nemm3a1cnf
MD5

e25c0b966dcade61c857fd9ad7d88acb
SHA1

fbd284b5ab419546b655b57a9dd4e67fa7bced39
SHA256

9cb327ce759be960e3ba338e7e28cbbd9a2ce4f7f009e36e46ce20ee6e626d9e
SHA512

c3feedaa4226748c65507fc15ea2edb717e281a4e767810023cd2a4890e556d0d9c31c4c771146d7a8639b3b93e18644eff3cf6e17087f9c5d612b3dc40467f1
SSDEEP

24576:QkcED6301quRH3jo6FpJzKTgbu+T/3Az9AiDAQ965OF5Hk2FOJsFwzZLEHLHHtdr:WepN3n4T8uIQx3965OFtRFjFwqHrnr

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  e25c0b966dcade61c857fd9ad7d88acb_JaffaCakes118
- Size
  
  1.4MB
- MD5
  
  e25c0b966dcade61c857fd9ad7d88acb
- SHA1
  
  fbd284b5ab419546b655b57a9dd4e67fa7bced39
- SHA256
  
  9cb327ce759be960e3ba338e7e28cbbd9a2ce4f7f009e36e46ce20ee6e626d9e
- SHA512
  
  c3feedaa4226748c65507fc15ea2edb717e281a4e767810023cd2a4890e556d0d9c31c4c771146d7a8639b3b93e18644eff3cf6e17087f9c5d612b3dc40467f1
- SSDEEP
  
  24576:QkcED6301quRH3jo6FpJzKTgbu+T/3Az9AiDAQ965OF5Hk2FOJsFwzZLEHLHHtdr:WepN3n4T8uIQx3965OFtRFjFwqHrnr
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Modifies WinLogon
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2