432ef4a50213cba3dd785700715e615c902a06b740b906fb3ac5a8aaaa7d2d23 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e275fcb2a73abf7c093ec464bcdb176f_JaffaCakes118
Size

15KB
Sample

240915-pe7hxataje
MD5

e275fcb2a73abf7c093ec464bcdb176f
SHA1

1cf65797345e5250de7669528d6fef8dbc9479a0
SHA256

432ef4a50213cba3dd785700715e615c902a06b740b906fb3ac5a8aaaa7d2d23
SHA512

9edb8c6abbb0dcf5888d1994befbd80465639139af42ae5be8d2690cc85d227c295b5d61ecd799e913e716d3634c963bee8a6763cd21dc5e3d422f1d03ff42a1
SSDEEP

384:5D6LJAFhpDnnrdX4t/Zf45rNZm7yVAL1v:xlrdXgwZgyGL

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  e275fcb2a73abf7c093ec464bcdb176f_JaffaCakes118
- Size
  
  15KB
- MD5
  
  e275fcb2a73abf7c093ec464bcdb176f
- SHA1
  
  1cf65797345e5250de7669528d6fef8dbc9479a0
- SHA256
  
  432ef4a50213cba3dd785700715e615c902a06b740b906fb3ac5a8aaaa7d2d23
- SHA512
  
  9edb8c6abbb0dcf5888d1994befbd80465639139af42ae5be8d2690cc85d227c295b5d61ecd799e913e716d3634c963bee8a6763cd21dc5e3d422f1d03ff42a1
- SSDEEP
  
  384:5D6LJAFhpDnnrdX4t/Zf45rNZm7yVAL1v:xlrdXgwZgyGL
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Blocklisted process makes network request
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence